UK Biobank Health Data Listed for Sale on Alibaba

The U.K. government is working with Chinese officials to remove de-identified data pertaining to 500,000 volunteers in a long-term disease prevention study. The data was listed for sale on Chinese e-commerce site Alibaba. British officials said the incident did not appear to involve a cyberattack.

The UK Biobank is a non-profit, non-governmental effort that calls itself the “world’s most comprehensive dataset of biological, health and lifestyle information.” The dataset include genomic, health records, medical imaging data and an array of other sensitive health information.

The organization makes volunteer data available for use by public interest health researchers. In a April 23 statement, it said that a week earlier it found on Alibaba de-identified participant data earlier shared with researchers at three unnamed academic institutions.

“With support from both the U.K. and Chinese governments, Alibaba swiftly removed these listings, and we were advised that no sales had been made. This is a clear breach of the contract signed by these academic institutions and they, along with the individuals involved, have had their access suspended,” UK Biobank said. It told the government the data did not contain participants’ names, addresses, contact details or telephone numbers.

The Guardian reported Wednesday that additional health records had been listed on Alibaba and that officials are “braced” for the possibility of more leaks.

UK Biobank said it instituted “a strict limit on the size of files that can be taken off the platform.” The new control will let researchers export research but limit their ability to download participant data, it said. The organization is conducting a forensic investigation into the incident. “Researchers are required to do their research on our restricted, cloud-based research platform hosted in the U.K. data,” it said.

The organization notified the government on April 20 about the incident. One of the data sets, said Conservative peer Nick Markham in a Tuesday session of the House of Lords, appeared to contain data from all 500,000 volunteers.

In an exchange about the incident Labour peer John Reid said that “although this was not a cyberattack, changing the behavioral aspects which led to this leak will not be sufficient.”

Rather, “it will require a range of cultural, behavioral and technical effects to try to minimize the chances of this happening again,” he said.