British Government Reveals DNA and Health Data of 500,000 Volunteers Exposed in Major Breach

The British government confirmed on Thursday that confidential health records from half a million volunteers in the UK Biobank project were offered for sale online in China following a data breach earlier this week.

The information, which includes DNA and other sensitive health data, was found listed for sale on the Alibaba e-commerce platform, Technology Minister Ian Murray told lawmakers. He stated that names, addresses, contact details, or telephone numbers were not included in the data, but noted that the information could still potentially allow identification through details such as gender, age, month and year of birth, socioeconomic status, lifestyle habits, and biological sample measurements.

Murray explained that the data had been legitimately downloaded by three research institutions in China, whose access has since been revoked. He described the breach as an “unacceptable abuse” of the UK Biobank’s data and a violation of the trust participants place in the charity when sharing their information for research purposes.

The UK Biobank, which collects detailed health information from volunteers aged 40 to 69 who joined the study between 2006 and 2010, provides data used to assess how diseases develop. Participants contribute lifestyle information via online questionnaires, consent to the use of their health records, and some provide body scans, blood, urine, and saliva samples, or wear physical activity and heart health monitors.

The minister said the government is working with Chinese authorities and Alibaba to determine how the breach occurred and to ensure any further listings are removed. He thanked the Chinese government for its cooperation in swiftly taking down the advertised listings.

UK Biobank has referred itself to the Information Commissioner’s Office following the incident. The charity confirmed that at least one of the three identified listings on Alibaba appeared to contain data from all 500,000 volunteers.

This incident follows previous revelations that sensitive UK Biobank data has been exposed online multiple times in recent months, prompting renewed concerns about the adequacy of security measures protecting the database.