UK Biobank Prepares to Relaunch Research Platform After Major Health Data Leak

UK Biobank (UKB) has announced that its Research Analysis Platform (UKB-RAP) is now considered "secure" and is awaiting final approvals to reopen to academic researchers. The platform has been inaccessible since an April incident that led to the exposure and attempted sale of health data belonging to all 500,000 volunteers on the Chinese e-commerce site Alibaba. This dataset, comprising approximately 30 petabytes of genomic information from individuals aged 40-69 collected between 2006 and 2010, is crucial for research into conditions like cancer, dementia, and COVID-19 immunity.

Professor Sir Rory Collins, CEO at UKB, confirmed that the security enhancements have been completed and validated by an independent cybersecurity firm, which recommended the platform's reopening. The relaunch will be phased, starting with a "manual output checking system" where human reviewers will vet files researchers intend to download. This measure precedes an automated process planned for next year, aiming to prevent unauthorized data exfiltration.

Significant changes are being implemented to restrict researcher activities. Until the manual checking system is fully operational, researchers will face limitations on building public applications and sharing tools externally. They will also be unable to refresh or dispense data, being restricted to working with pre-existing datasets. Furthermore, the platform will enforce automatic logouts after 15 minutes of inactivity, requiring mandatory two-factor authentication (2FA) upon re-authentication.

Technical security upgrades include the removal of SSH access for jobs, the introduction of "isolated browsing" for interactive tools to limit data transfer to local systems, and restrictions on command-line interface (CLI) usage. UKB's long-term goal is for researchers to operate entirely within the platform's hosted repositories, without storing any data on their personal computers.

The incident also highlighted issues with researchers inadvertently including de-identified participant data within their code repositories. UKB conducts daily automated scans to detect such errors and provides training to researchers. However, despite reminders, some researchers have failed to remove this data. Collins stated that sanctions are being applied to those responsible, including mandatory relocation of analyses to UKB-RAP, deletion of downloaded data, and additional training before platform access is reconsidered.

Initially, UK Biobank had targeted a September 2026 relaunch. However, a recent update indicated a delay pending the completion of an independent assessment, even after the necessary security improvements were already in place. The charity is now awaiting approval from health data controllers and central government before proceeding with the phased reopening of the platform to its more than 20,000 active researchers.