{
  "id": 16601133,
  "title": "UK Biobank back online soon, months after someone tried to sell 500k people's data on Alibaba",
  "url": "https://urgent.news/2026/10/26/uk-biobank-back-online-soon-months-after-someone-tried-to-sell-500k-16601133",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T12:38:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/10/26/uk-biobank-back-online-soon-months-after-someone-tried-to-sell-500k-peoples-data-on-alibaba/5305363"
  },
  "original_language": "en",
  "account": "The UK Biobank, a charity that manages the world's largest biomedical dataset, announced that its platform will soon be secure and accessible to researchers once again. The platform, known as UKB-RAP, was locked out after a major data breach in April, during which 500,000 volunteers' health data was listed for sale on Alibaba, a Chinese ecommerce website. The breach led to the restriction of access for over 20,000 researchers who used the dataset for various health-related studies, including investigations into cancer, dementia, Parkinson’s disease, and COVID-19 immunity.\n\nProfessor Sir Rory Collins, the CEO of UK Biobank, stated that the platform has been secured and independently verified by a cybersecurity firm, which recommended its reopening. UK Biobank will now proceed with a phased reintroduction of researchers, including a manual output checking system where human reviewers will inspect files before allowing access. This system will be followed by an automated process expected to be implemented next year.\n\nResearchers will face several restrictions during the reintroduction, including the inability to download result files, build public apps, or share tools with external colleagues until the manual checking system is fully operational. They will also be restricted from refreshing or dispensing data, with automatic logout occurring after 15 minutes of inactivity. Two-factor authentication (2FA) will be required upon re-authentication.\n\nTechnical changes include the elimination of SSH access to jobs, the use of isolated browsing for interactive tools, and certain restrictions on command-line interface (CLI) use. UK Biobank is working towards a future where researchers only work with data uploaded to their hosted repositories, but de-identified data has accidentally been included in some code repositories. The organization has been running daily automated scans to identify and address these errors, providing training to researchers to prevent such occurrences.\n\nDespite warnings, some researchers have not deleted de-identified participant data from their projects, and these individuals will not be allowed back into the UKB-RAP until they take the necessary actions. Sanctions are being imposed on researchers who expose participant data in their code, requiring them to move their analyses to UKB-RAP, delete any downloaded data, and undergo additional training before being reinstated.",
  "summary": "Charity confirms slew of security improvements as it waits for UK.gov's go-ahead",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}