UK Biobank health data of 500,000 volunteers continues to appear for sale on Alibaba; minister warns of further leaks
Science minister Patrick Vallance told the House of Lords that additional listings of UK Biobank data have appeared on Alibaba since the breach was first reported, and the government expects further leaks. The data, belonging to 500,000 volunteers, is de-identified but carries a risk of re-identification.
New listings of confidential health data belonging to 500,000 UK Biobank volunteers have appeared on the Chinese e-commerce platform Alibaba since the breach was first disclosed last week, and the government expects further leaks, Science Minister Patrick Vallance told the House of Lords on Wednesday.
Vallance said the government had worked with Chinese officials to remove additional postings on the online marketplace. “New listings will emerge – there have been additional listings posted since the government were made aware of the issue last week – and we continue to work with the Chinese government to remove them quickly,” he said.
The data is de-identified, meaning it does not include names, addresses or precise dates of birth. Vallance said there was a “low probability” of re-identification but called the breach a “real wake-up call” for researchers. “It is increasingly possible to triangulate in large datasets and get close to identification, and that remains a very real risk,” he said.
Technology Minister Ian Murray made an emergency statement last Thursday revealing the breach. UK Biobank learned of the breach from an anonymous whistle-blower. Officials do not believe there were any sales of the data. All access to UK Biobank data has been temporarily suspended.
Vallance named three Chinese institutions whose researchers are understood to be behind the postings: Second Xiangya Hospital, China-Japan Union Hospital, and Beijing Chaoyang Hospital.
In addition to the Alibaba posts, UK Biobank has taken action on at least 30 other data breaches in the past month, according to Dr. Luc Rocher of the Oxford Internet Institute, who has been tracking data breaches. A detailed dataset relating to 96,000 volunteers, apparently accidentally uploaded by a masters student at Yale University, remains online. UK Biobank said it had asked for the data to be removed and that removal should be completed shortly.
Chi Onwurah, chair of the Commons science, innovation and technology committee, said: “I’m astounded that that data is still available online. UK Biobank have been complacent about the half a million British people who have shared their most intimate and personal data with them and who deserve better than this.”
A government spokesperson said: “We are aware of reports that unauthorised data from UK Biobank – a health research charity independent of government – is being made available online following a leak which was reported last month. As you would expect, we are working with UK Biobank to understand its origin and extent of this data, and to ensure they are taking proactive steps to get it removed.”