UK Biobank Says Research Platform Is Secure After Data Leak

UK Biobank (UKB) says its cloud-based Research Analysis Platform, UKB-RAP, is now secure and that researchers will soon regain access. The platform has been closed to all medical researchers since an attack in April, which led to the data of all 500,000 volunteers being listed for sale on the Chinese ecommerce site Alibaba.

CEO Professor Sir Rory Collins said the charity has completed the work needed to secure the platform and that an independent cybersecurity company checked it and recommended reopening. UKB is still waiting for approval from health data controllers and central government. It had originally told researchers to expect a relaunch by September 2026, but said last month it had to wait for the independent assessment.

More than 20,000 researchers use the platform, which offers around 30 petabytes of data collected from people aged 40 to 69 between 2006 and 2010. It supports work on cancer, dementia, Parkinson's disease and COVID-19 immunity.

Tighter rules for researchers

Researchers will return in phases, and at first they cannot download results files. UKB will pilot a manual output checking system, in which human reviewers inspect files before release, ahead of an automated process expected next year. Until it is fully running, building public apps and sharing tools with external colleagues is restricted.

Other changes include no refreshing or dispensing of data, automatic logout after 15 minutes of inactivity with 2FA on re-authentication, no SSH into jobs, interactive tools run through isolated browsing, and some CLI restrictions. UKB's goal is for researchers to store no data on their own computers.

Exposed data in code repositories

De-identified participant data has accidentally ended up in code uploaded to online repositories. UKB runs daily automated scans and provides training. Collins said most researchers have confirmed deleting de-identified data from their projects, but a small number of repositories still contain it. Those cases are a serious breach of the Material Transfer Agreement, and sanctions are being applied.

Researchers who are caught exposing data must move their analyses to UKB-RAP, delete downloaded data and complete extra training before returning. Those who have not confirmed deletion will not be readmitted until they do.