The UK Biobank breach has been described as “limited” because the data involved was anonymised. That means no names, addresses or obvious identifiers.
But that doesn’t mean no risk.
Following the breach, questions are now being raised about whether the data could still be used to identify individuals.
What was exposed in the UK Biobank breach?
UK Biobank is a large-scale medical database made up of volunteers across the UK. Participants originally joined between 2006 and 2010, providing health information, lifestyle details and biological samples.
Last week, technology minister Ian Murray told MPs there had been a serious data incident, which resulted in highly confidential Biobank information being listed for sale. The technology minister also said there was no guarantee individuals could not be identified from the data.
This wasn’t a hack. The data was accessed legitimately by an approved research organisation, and then allegedly put up for sale in breach of its agreement.
The data has since been found on three separate listings on the Chinese e-commerce site Alibaba. According to the technology minister, ‘At least one of these three datasets appeared to contain data from all 500,000 UK Biobank volunteers’.
This isn’t generic data. It’s:
- Long-term health information
- Linked to biological samples
- Built to be detailed enough for medical research.
In simple terms, the data was anonymised, but still highly detailed. And that level of detail can increase the risk of re-identification.
The government has said there is no evidence the data was purchased before the listings were taken down. However, concerns remain, as once data is exposed it can be difficult to fully contain:
- The data was listed online, meaning it could have been copied before removal
- Multiple listings suggest wider access or distribution.
This raises questions about how widely the data may have been shared before it was taken down.
Experts have warned about this before
Academic research and real-world reporting have shown that, in some cases, individuals can be identified from anonymised datasets using only a small number of data points.
There have also been instances where:
- Health data has been linked back to individuals through cross-referencing
- Supposedly anonymous records have been matched with other datasets
- Publicly available information has been enough to confirm identities.
In the context of UK Biobank, that raises a clear concern: if someone had access to both this dataset and other data sources, could they piece together who is who?
If re-identification were possible, the implications are serious.
Health data can reveal:
- Medical conditions
- Genetic risks
- Lifestyle choices
- Personal circumstances.
In the wrong hands, that could lead to:
- Profiling or targeting
- Discrimination
- Blackmail or coercion.
Even if those outcomes are unlikely, the exposure itself changes the risk landscape.
For many people, even if the data was anonymised, knowing that sensitive health information has been exposed can feel unsettling.
Participants shared details about their bodies, lifestyles and medical histories in good faith, often to support research that could benefit others. Finding out that this data may have been mishandled or listed for sale can lead to a loss of trust, anxiety about how it might be used, and a sense that something private has been taken out of their control.
The data may have been anonymised, but the concerns it raises are very real. As investigations continue, questions around data control, trust and accountability are unlikely to go away.
At this stage investigations into the Biobank breach are ongoing. It is not yet clear whether any legal action will follow. If a group action or formal claim is investigated by a regulated partner law firm, we’ll explain what it means and how to take part.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
