The medical details of 500,000 volunteers of UK health information database Biobank have been offered for sale online in a data breach, the government has revealed.
The Technology Minister, Ian Murray, said the data was advertised for sale by several sellers on Alibaba’s e-commerce platforms in China. He described it as “an unacceptable abuse of the UK Biobank charity’s data and abuse of the trust that participants readily expect”.
The Biobank informed the government of the breach three days ago. The UK Biobank is the world’s most comprehensive dataset of biological, health and lifestyle information and is used by researchers around the world for a wide range of studies on what happens as people age. The charity says it removes personal identifying information, such as names and addresses, on all 500,000 volunteers before giving scientists access to the data.
Those joining UK Biobank were between 40 and 69 years of age when they joined the study between 2006-2010. Data from it has been cited in more than 18,000 peer-reviewed scientific papers, including on major causes of ill-health. These range from lung and cardiovascular conditions, to mental health conditions and arthritis.
Mr Murray admitted he could not guarantee that no one could be identified by Biobank’s data. He added that it was “unclear” how the dataset ended up on the web.
He said the information had been legitimately downloaded by three research institutions in China who have since had their access revoked.
Mr Murray told the Commons: “Biobank told us that three listings that appear to sell … Biobank participation data had been identified. At least one of these three datasets appeared to contain data from all 500,000 UK Biobank volunteers.”
He said Biobank has advised that this data did not contain participants' names, addresses, contact details or telephone numbers. The government has said discussions suggest that none of the information had been sold before the listings were taken down.
In a statement published on Thursday, Professor Sir Rory Collins, chief executive and principal investigator of UK Biobank, told those in the study: “We would like to inform you about an incident involving UK Biobank data.
"We apologise to our participants for the concern this will cause, and we hope to provide reassurance by outlining the serious actions we are taking in response. Your personally identifying information in UK Biobank is safe and secure.
“Listings offering access to UK Biobank data (which did not contain any personally identifying information) were found on a Chinese consumer website. These listings were swiftly removed before any purchases were made.
“We are putting in place additional security measures to prevent this happening again. We will conduct a comprehensive investigation into this incident. Since UK Biobank started to make your de-identified data available for research in 2012, it has led to thousands of discoveries that are already leading to improvements in the prevention and treatment of many different diseases.”
UK Biobank has referred itself to the Information Commissioner’s Office following the data breach. Mr Murray said the government had worked with Biobank, the Chinese government and the vendor to ensure the three listings had been removed.
“I want to thank the Chinese government for the seriousness with which they work with us to help remove these listings. Secondly, we ensured that the Biobank charity revoked access to three research institutions identified as the source of that information.
“And thirdly, we have asked that the Biobank charity pause further access to its data until they put in place a technical solution to prevent data from its current platform from being downloaded in this way again. I can confirm to the House that this pause is now in place.”
“We wrote out to businesses last week about the cybersecurity tools available to them for free from Government and the steps they should take to maximise security. Ensuring the safe use of UK Data is a priority for this Government.”
