Security News

UK Biobank Plans Phased Reopening With Tighter Controls After Data Listed for Sale

The Register · 26 Oct 2026
Key Takeaway If you hold sensitive data, limit how it can be shared or exported, review outputs before release, and enforce automatic logouts and two-factor authentication.

UK Biobank, the charity that runs a large biomedical research project, says its Research Analysis Platform is now secure and that academics will soon regain access. The platform has been closed to researchers since an April attack, which led to data on all 500,000 volunteers being listed for sale on the Chinese ecommerce site Alibaba. More than 20,000 researchers use the platform to study conditions including cancer, dementia, Parkinson's disease and COVID-19 immunity.

Chief executive Professor Sir Rory Collins said the organisation has completed the work needed to secure the platform. An independent cybersecurity company checked that progress, and its report recommends reopening. The charity is still waiting for approval from health data controllers and central government before it relaunches.

Return will be phased, with new restrictions. Researchers will not be able to download results files at first. Instead, a manual output checking system will have human reviewers inspect files before release, ahead of an automated process expected next year. Until that system is fully running, researchers cannot build public apps or share tools with external colleagues. They can only work with existing data, not refresh or dispense it. Users will also be logged out automatically after 15 minutes of inactivity, with two-factor authentication required to sign back in.

data breach UK Biobank access control healthcare data two-factor authentication

Summarised by CISO AI from The Register, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.