UK Biobank back online soon, months after someone tried to sell 500k people's data on Alibaba

UK Biobank (UKB) says its platform is now "secure" and that academics will soon regain access, months after a major data leak of volunteer health data.

The charity, which runs the eponymous research project and describes itself as the custodian of the world's most comprehensive biomedical dataset, said it is waiting for approval from health data controllers and central government before it relaunches the platform.

UK Biobank's Research Analysis Platform (UKB-RAP) has locked out all medical researchers trying to access its dataset since the April attack, which led to all 500,000 volunteers’ data being listed for sale on Chinese ecommerce website Alibaba.

More than 20,000 researchers use the dataset provided by the cloud-based platform. They upload research projects and run experiments informed by the genomic data UKB collected from 40-to-69-year-olds between 2006 and 2010.

The org makes around 30 petabytes worth of the stuff available to researchers, who investigate conditions including cancer, dementia, Parkinson’s disease, and COVID-19 immunity.

Professor Sir Rory Collins, CEO at UKB, said on Friday that the organization has "completed the work to ensure that the UKB-RAP is secure," and that the progress was checked by an independent cybersecurity company, whose report recommends reopening the platform.

The charity will begin a phased re-introduction of researchers to its platform after it receives the necessary approvals, although boffins will not be able to download any results files at first.

The platform will pilot a "manual output checking system," where human reviewers will inspect files researchers wish to download before allowing them to do so, ahead of an automated process expected to roll out next year.

According to the guide UKB compiled for researchers outlining the changes to the platform, researchers will also be restricted from building public apps and sharing tools with external colleagues until that manual checking system is fully up and running.

Researchers were also warned that they will not be able to refresh or dispense data, only work with pre-existing data. They were also told to expect automatic logout out after 15 minutes of inactivity, with 2FA required upon re-authentication.

Other technical changes include no longer being able to SSH into jobs, interactive tools being run via "isolated browsing" which restricts data transfer between web apps and the user's local system, and some restrictions on CLI use.

UKB is working toward a day when the researchers using its platform store no data on their own computers, working only with that which is uploaded to the repos it hosts.

However, in uploading this data to online repos, de-identified data is accidentally included in the code.

UKB says it runs daily automated scans of these repos to catch errors, and provides training to researchers to help prevent these occurrences.

Collins said that since the attack, most researchers have confirmed the deletion of de-identified data from their projects, but others have not and won't be admitted back to the UKB-RAP until they do.

"Despite our repeated reminders, we are still detecting a small number of code repositories that include de-identified participant data," he said. "As these constitute a serious breach of the Material Transfer Agreement, sanctions are being applied against the researchers who are responsible."

The charity also said researchers caught exposing participant data in their code will be forced to move their analyses to UKB-RAP, delete any downloaded data, and undergo additional training before being allowed back on the platform.

It had initially told researchers to expect a relaunch of the platform by September 2026, although an update penned last month confirmed that it needed to wait for an independent assessment to be completed, despite already making the required security improvements. ®