UK Biobank Restores Security After Data Leak Compromises 500,000 Records

"Completed the work to ensure that the UKB‑RAP is secure," Professor Sir Rory Collins, CEO at UK Biobank, told staff on Friday — a curt summary of months of lockdown and remediation after a major breach.

UK Biobank and the UKB‑RAP: the dataset at stake

UK Biobank (UKB), which calls itself the custodian of the world's most comprehensive biomedical dataset, has kept its cloud‑based Research Analysis Platform (UKB‑RAP) offline to researchers since an April attack. The incident resulted in data on all 500,000 volunteers being listed for sale on the Chinese ecommerce site Alibaba. More than 20,000 researchers rely on UKB‑RAP, which makes roughly 30 petabytes of data available — including genomic material collected from 40‑to‑69‑year‑olds between 2006 and 2010 — to support research into cancer, dementia, Parkinson’s disease and COVID‑19 immunity.

Security changes and technical controls being imposed

UK Biobank says it has implemented a suite of technical and procedural changes and that an independent cybersecurity company reviewed the work and recommended reopening. When researchers are gradually readmitted, they will initially be unable to download results files. The platform will pilot a "manual output checking system" in which human reviewers inspect files researchers wish to download; an automated output checking process is expected to be introduced next year.

Other measures UKB has announced include:

• Restrictions on building public apps and sharing tools with external colleagues until the manual checking system is fully operational;
• Researchers will not be able to refresh or dispense data and must work only with pre‑existing data on the platform;
• An automatic logout after 15 minutes of inactivity and mandatory two‑factor authentication on re‑authentication;
• No SSH access into jobs, interactive tools executed via "isolated browsing" that restricts data transfer between web apps and local systems, and limits on command‑line interface (CLI) use.

Repository scans, accidental disclosures, and sanctions

UK Biobank is pursuing a policy that researchers should store no UKB data on their own machines and instead work with repositories hosted by UKB. But the charity acknowledges that de‑identified participant data can be accidentally included in code uploaded to those repos. UKB runs daily automated scans of those repositories and provides training intended to reduce mistakes.

Professor Collins said most researchers have confirmed deletion of de‑identified data from their projects following the attack, "but others have not and won't be admitted back to the UKB‑RAP until they do." He added: "Despite our repeated reminders, we are still detecting a small number of code repositories that include de‑identified participant data. As these constitute a serious breach of the Material Transfer Agreement, sanctions are being applied against the researchers who are responsible." Researchers found exposing participant data in code will be required to move analyses to UKB‑RAP, delete any downloaded data, and undergo additional training before being permitted to return.

Approvals, the independent assessment, and the relaunch timeline

Although UKB says it has "completed the work to ensure that the UKB‑RAP is secure," the charity is waiting for approval from health data controllers and central government before reintroducing researchers. UKB had initially told researchers to expect a relaunch by September 2026 but later confirmed it needed to wait for an independent assessment to be completed despite implementing the required security improvements. The phased re‑introduction will begin once those approvals are received.

What this means for researchers, health data controllers, and volunteers

• Researchers: More than 20,000 users must accept tighter controls on how they run analyses and share tools; initial limits will include no downloads of results and bans on public apps until manual output checks are in place.
• Health data controllers and central government: Their approvals are now the gating item for reopening; the independent cybersecurity company’s recommendation does not replace those statutory reviews.
• Volunteers: Data on all 500,000 participants was exposed in the April listing on Alibaba; UKB is imposing repository scanning, mandatory deletions, and sanctions to reduce the risk of further disclosures.

UK Biobank is reopening in stages with human oversight of outputs as a bridge to automation next year. The charity’s approach ties technical lockdowns to behavioural remediation — scans, training, and sanctions — and places the final decision to resume full service in the hands of health data controllers and central government. Whether the manual‑checking pilot and the repository scans will be sufficient to prevent future leaks remains to be seen; the next visible milestone will be the formal approvals that permit the phased re‑introduction of researchers to UKB‑RAP.

Original story