The medical data of half a million UK Biobank volunteers has been discovered for sale on China’s largest online marketplace, the UK Government has confirmed.

Addressing MPs in the Commons, Ian Murray, minister for digital government and data, said that on 20th April, the Biobank informed the authorities of three listings advertised on e-commerce platform Alibaba that contained participant data, with one dataset appearing to contain data from all 500,000 UK Biobank volunteers. 

Murray stressed that the government had taken immediate action, working with the Biobank, Chinese officials, and the vendor to have the data swiftly removed before any sales were made, with the Biobank also revoking access from the research institutions identified as the source of the leak.

The government also asked the non-profit to pause further access until technical solutions can be put in place to stop volunteer data from being downloaded in the same way in future. 

The minister said that none of the data discovered for sale contained participant names, addresses, contact details, or telephone numbers, with the Biobank voluntarily referring itself to the Information Commissioner’s Office.

“We are still working with Biobank to ascertain from them the specific details of what has happened. We have asked them to investigate how this data ended up for sale online as a priority,” said Murray.

“We have received assurance that the charity will conduct a rapid board-level review of the safeguards in place for accessing their data.”

Recommended reading

• Report: Cyber Breaches Are Tanking Share Prices
• Report: 93% of Data Breaches Expose Financial Records
• ‘Reservation Hijack’ Warning Issued After Booking.com Breach

In a separate message to participants, Professor Sir Rory Collins, chief executive of UK Biobank, reaffirmed that all personally identifying information was secure and that access has been severely restricted while the investigation is underway.

“We have temporarily suspended all access to the UK Biobank research platform, while we put in place a strict limit on the size of files that can be taken off the platform,” wrote Collins. 

“In addition, all files exported from the research platform will be monitored daily for any suspicious behaviour. These security measures will further minimise the potential for misuse of UK Biobank data.”

Collins also confirmed that the Biobank is working on an automated checking system able to prevent de-identified data from being taken off the research platform, but without hindering important research. This system is expected to be in place by the end of the year.