UK Biobank says research platform is secure and nears relaunch months after April breach that saw 500k volunteers' data listed on Alibaba
UK Biobank (UKB) says its Research Analysis Platform (UKB-RAP) is now secure and that researchers will regain access in phases once health data controllers and central government approve. Access has been suspended since an April 2026 incident in which data on all 500,000 volunteers was listed for sale on Chinese ecommerce site Alibaba. CEO Professor Sir Rory Collins said an independent cybersecurity firm reviewed the remediation and recommended reopening. The relaunch slipped from the original September 2026 target because the independent assessment had to finish first. UKB is also sanctioning researchers who exposed de-identified participant data in code repositories.
Detalhes técnicos
- Over 20,000 researchers use the cloud platform, which holds roughly 30 petabytes of genomic and health data collected from 40-to-69-year-olds between 2006 and 2010.
- Researchers will first be unable to download results. A manual output-checking pilot will precede an automated process planned for next year.
- Building public apps and sharing tools externally is restricted until manual checking is fully running. Researchers cannot refresh or dispense data, only work with existing data.
- Sessions log out automatically after 15 minutes of inactivity, with 2FA on re-authentication. SSH into jobs is removed, interactive tools run via isolated browsing that restricts data transfer to the local system, and CLI use is partly restricted.
- UKB wants researchers to store no data locally. It runs daily automated scans of code repositories and still detects a small number containing de-identified participant data, which it treats as a serious breach of the Material Transfer Agreement.
Remediação
- Researchers must confirm deletion of de-identified data from their projects before being readmitted.
- Researchers caught exposing participant data in code face sanctions. They must move analyses to UKB-RAP, delete downloaded data and complete additional training before regaining access.
- UKB provides researcher training and runs daily automated repository scans to catch errors.
Linha do tempo
-
UK Biobank says research platform is secure and nears relaunch months after April breach that saw 500k volunteers' data listed on Alibaba
ler a análise desta fonte ocultar
UK Biobank (UKB) says its Research Analysis Platform (UKB-RAP) is now secure and that researchers will regain access in phases once health data controllers and central government approve. Access has been suspended since an April 2026 incident in which data on all 500,000 volunteers was listed for sale on Chinese ecommerce site Alibaba. CEO Professor Sir Rory Collins said an independent cybersecurity firm reviewed the remediation and recommended reopening. The relaunch slipped from the original September 2026 target because the independent assessment had to finish first. UKB is also sanctioning researchers who exposed de-identified participant data in code repositories.
Technical Details
- Over 20,000 researchers use the cloud platform, which holds roughly 30 petabytes of genomic and health data collected from 40-to-69-year-olds between 2006 and 2010.
- Researchers will first be unable to download results. A manual output-checking pilot will precede an automated process planned for next year.
- Building public apps and sharing tools externally is restricted until manual checking is fully running. Researchers cannot refresh or dispense data, only work with existing data.
- Sessions log out automatically after 15 minutes of inactivity, with 2FA on re-authentication. SSH into jobs is removed, interactive tools run via isolated browsing that restricts data transfer to the local system, and CLI use is partly restricted.
- UKB wants researchers to store no data locally. It runs daily automated scans of code repositories and still detects a small number containing de-identified participant data, which it treats as a serious breach of the Material Transfer Agreement.
Remediation
- Researchers must confirm deletion of de-identified data from their projects before being readmitted.
- Researchers caught exposing participant data in code face sanctions. They must move analyses to UKB-RAP, delete downloaded data and complete additional training before regaining access.
- UKB provides researcher training and runs daily automated repository scans to catch errors.