UK Biobank platform to reopen soon after Alibaba data sale scare

UK Biobank says its Research Analysis Platform is now secure and that academics will soon regain access, months after all 500,000 volunteers' data was listed for sale on Alibaba. The charity is waiting for approval from health data controllers and central government before relaunching the cloud-based service. More than 20,000 researchers use the dataset, which supports studies of cancer, dementia, Parkinson's disease and COVID-19 immunity.

Independent review backs reopening

Professor Sir Rory Collins, chief executive at UK Biobank, said on Friday that the organization had completed work to ensure the platform is secure. An independent cybersecurity company checked that progress and its report recommends reopening the platform. UK Biobank had initially told researchers to expect a relaunch by September 2026, but an update last month said it needed to wait for an independent assessment despite already making the required security improvements.

Phased return with manual checks

The charity will begin a phased re-introduction of researchers after it receives the necessary approvals, although researchers will not be able to download results files at first. It will pilot a manual output checking system in which human reviewers inspect files researchers wish to download before allowing them to do so, ahead of an automated process expected next year. Researchers will also be restricted from building public apps and sharing tools with external colleagues until that manual checking system is fully up and running.

Technical changes and data rules

Researchers were warned they will not be able to refresh or dispense data and will only be able to work with pre-existing data. They should expect automatic logout after 15 minutes of inactivity, with two-factor authentication required upon re-authentication. Other changes include no longer being able to SSH into jobs, interactive tools being run via isolated browsing that restricts data transfer between web apps and the user's local system, and some restrictions on command-line use.

De-identified data in code

UK Biobank says it is working toward a day when researchers using its platform store no data on their own computers and work only with data uploaded to the repositories it hosts. However, de-identified data is accidentally included in code when data is uploaded to online repositories. The charity runs daily automated scans of those repositories to catch errors and provides training to researchers to help prevent such occurrences.

Sanctions for exposed participant data

Collins said most researchers have confirmed deletion of de-identified data from their projects since the attack, but others have not and will not be admitted back to the platform until they do. He said UK Biobank is still detecting a small number of code repositories that include de-identified participant data. As these constitute a serious breach of the Material Transfer Agreement, sanctions are being applied against the researchers responsible. Researchers caught exposing participant data in their code will be forced to move their analyses to the platform, delete any downloaded data, and undergo additional training before being allowed back.

Sources: The Register