UK Biobank says security work is complete after 500,000-person data leak

UK Biobank says it has completed security work on its research platform, but more than 20,000 researchers remain locked out while it awaits approval from the UK government and health data controllers to reopen.

In its October 26 report, The Register said access had been suspended since an April attack that led to data from all 500,000 volunteers being listed for sale on the e-commerce website Alibaba.

The charity’s cloud-based Research Analysis Platform gives researchers access to a dataset used to investigate cancer, dementia, Parkinson’s disease and other conditions. It includes genomic data collected from people aged 40 to 69 between 2006 and 2010.

What researchers could do on return

UK Biobank chief executive Professor Sir Rory Collins said an independent cybersecurity company had checked the completed security work and recommended reopening in its report. The charity had initially told researchers to expect access to resume by September 2026, but later said it needed to wait for the independent assessment.

Once approvals arrive, UK Biobank plans to bring researchers back in stages. They would initially be able to work only with data already available to their projects and would not be allowed to download any results files.

The charity plans to pilot human checks on files researchers want to download before allowing those files to leave the platform. An automated checking process is expected in 2027. Its researcher guide also restricts building public apps and sharing tools with external colleagues until the manual checks are fully operational.

Sanctions for exposing participant data

Collins said UK Biobank was still finding a small number of online code repositories containing de-identified participant data—data with identifying details removed—and that these exposures breached the Material Transfer Agreement governing researchers' use of the data and that sanctions were being applied to those responsible.