Data Breach Shuts Down Leading Research Biobank: Key Recovery Lessons Learned

On a Tuesday in mid-April, the UK Biobank—one of the world’s largest and most comprehensive health research databases—received an alarming email from an anonymous researcher. The sender had discovered that supposedly sensitive information from hundreds of thousands of research participants was being offered for sale on Xianyu, an e-commerce platform owned by Chinese technology company Alibaba.

With help from Alibaba and the governments of the United Kingdom and China, the UK Biobank successfully removed the listing. However, the incident raised serious concerns about biomedical data security, prompted an internal investigation and led the biobank to suspend researcher access while it developed new safeguards. After being offline for about five months, the UK Biobank has announced that it will begin reopening its research platform this month.

The UK Biobank stores extensive genetic information from around half a million people who have agreed to participate in research over several decades. Its resources also include medical images, health histories, lifestyle information and other biomedical data. The UK Biobank is one of several major biobanks available to researchers worldwide, but scientists say its scale and accessibility make it particularly valuable.

“We’ve learned more about human biology from UK Biobank research than I think we’ve learned from any other single resource,” says geneticist Daniel McArthur of the Garvan Institute of Medical Research in Sydney, Australia. He attributes this impact to the number of participants, the breadth of the data collected and the fact that researchers around the world could access the resource relatively easily.

The incident has highlighted the potential risks of making large-scale biomedical datasets widely available without strict security controls. According to the UK Biobank’s internal investigation, there have been three cases in which participant data was offered for sale online. All three incidents were linked to Chinese institutions. The listings have been removed, the institutions have been banned from further access and Alibaba has introduced automated searches to identify listings that mention biobanks.

This is not the first time a major research dataset has faced data security concerns. In March, The Guardian reported that UK Biobank data had been accidentally uploaded to the public code repository GitHub by a researcher. The report showed how the information could potentially be linked to individual research participants. In 2023, hackers also accessed sensitive information, including names, addresses and ancestry details, from millions of users of the consumer genetics company 23andMe.

UK Biobank and 23andMe have since reassessed their security protocols and updated their platforms to tighten data access. 23andMe was sued by affected users and agreed to pay more than $40 million in damages earlier this year. These developments reflect a broader trend among biorepositories to impose stricter rules on who can access health and genetic data and how that data can be used.

Although many researchers say the benefits of stronger security controls outweigh the drawbacks, some worry that additional restrictions could make it harder for authorized scientists to use valuable biomedical datasets effectively.

Finding the right balance between data accessibility and privacy protection is essential, says Joe Watts, data policy director at UK Biobank in Cambridge, UK. “We take the protection of participant data very seriously and take great care to remove personally identifiable information and vet researchers and institutions,” he says. “We recognize that we can do more and are adding additional security measures.”

Strengthening UK Biobank access controls

When the UK Biobank first opened to the scientific community in 2012, it operated under what was known as a “library lending” model. Approved researchers could download raw data and analyze it on their own computers and institutional systems.

To protect participant privacy, UK Biobank and other repositories remove or conceal personally identifiable information, such as names, addresses and dates of birth, through a process known as pseudonymization. This helps separate sensitive information—including data about drug and alcohol use, physical and sexual abuse and medical diagnoses—from a person’s direct identity.

However, pseudonymized data is not necessarily impossible to identify. If datasets are exposed online, researchers or malicious actors may be able to combine them with other information to determine the identity of individual participants. This process is known as re-identification.

Screening infants’ genomes could save lives. This is how it works

In its March report, The Guardian revealed that a UK Biobank participant had successfully linked health records that were mistakenly posted online using her birth year and the date of a surgery provided to the newspaper. In an report on security incidents published in April, UK Biobank said that although re-identification could not be ruled out, it was not aware of any cases in which a participant had been re-identified without their assistance.

The UK Biobank faced other data security concerns before the latest incident. According to The Guardian, the biobank issued several takedown notices to GitHub between July and December last year after researchers accidentally posted UK Biobank data to the platform.

Of the approximately 1,500 research institutions that downloaded the UK Biobank dataset, around 700 could not confirm that they had deleted the data after their approved period of use ended. UK Biobank said that institutions failing to delete the data would lose access to the biobank when its research platform reopens.

To reduce these risks, biobanks are increasingly adopting a “reading library” model. Under this approach, researchers cannot download participant-level data. Instead, they run analyses within a secure computing environment and can download only approved research results.

For example, the US National Institutes of Health’s All of Us Research Program is building a repository of genetic and other biomedical information from one million people. Participant-level data from the program can be accessed only through a secure, cloud-based platform.

UK Biobank began moving toward this type of secure research environment in 2021 and made the platform widely available to researchers in 2024. However, the system allowed users to download participant-level data by specifying individual participants. Although UK Biobank’s policies prohibited this practice, the organization did not have an automated system to monitor precisely what data researchers were exporting.

Many biobanks now use security systems known as “airlocks” to screen exported files and prevent participant-level information from leaving the research environment. UK Biobank is installing an airlock system and plans to begin rolling it out when its platform reopens.

Even airlock systems cannot eliminate every risk. Malicious users could potentially capture information through screenshots or other methods while viewing data inside a secure platform. Protecting participant information is an “ongoing process,” says Josh Denny, chief executive of All of Us. This includes regularly monitoring the internet for compromised data and alerting other biobanks when potential threats are identified.

For example, UK Biobank found that Xianyu listings referenced other biobanks, including All of Us. It alerted the program so that researchers could determine whether any participant-level data was being offered for sale, Denny says.

“When it comes to data security, there is no one silver bullet,” says Euan Barney, director of the European Bioinformatics Laboratory at the European Institute for Molecular Biology in Hinxton, UK. Multiple layers of protection can make it more difficult for researchers to make accidental mistakes and for malicious actors to misuse sensitive data, he adds.

Luc Rocher, a data privacy researcher at the University of Oxford’s Internet Institute in the UK, says biorepositories could go beyond airlock systems and other export controls. Researchers could instead submit code to a secure platform that analyzes participant data without giving them direct access to the underlying information. OpenSAFELY, operated by the University of Oxford, is one example of this approach.

Will secure data systems create research silos?

Although the reading library model is more secure than the lending library approach, it also creates challenges for biomedical research. Researchers who want to combine information from multiple biobanks typically need to sign in to each secure research environment, run similar analyses separately, export the results and then conduct a meta-analysis.

McArthur says that each national biobank is increasingly being placed within a customized computing environment. This makes it difficult to bring raw data together. Different systems may also have their own technical requirements, meaning that code designed for one platform might not work on another. Researchers therefore need to understand the complexities of every environment they use.

Open data is key to genomics research if you can keep the information safe

Several initiatives aim to reduce the need for researchers to repeat the same analysis across multiple databases. One approach is to combine summary statistics, such as the frequency of particular genetic variants or the results of genome-wide association studies (GWAS), rather than sharing individual-level data. Biobanks often make summary statistics publicly available because they are generally considered lower risk for participant privacy.

The Global Alliance for Genomics and Health is working to develop tools for integrating analyses across databases. The Genome Aggregation Database, or gnomAD, aims to combine summary statistics from biobanks around the world. Meanwhile, researchers from the Global Biobank Meta-Analysis Initiative have brought together data from more than 30 biobanks to support collaborative analyses of GWAS results.

As biobanks strengthen security protections, researchers and data custodians will continue to face the same central challenge: ensuring that valuable health and genetic data remains accessible for legitimate scientific research while protecting the privacy of the people who provided it.