UK Biobank Data Leaks: Patient Records Exposed Online

The UK Biobank, a vast repository of medical information from half a million British volunteers, has experienced numerous data security breaches, with confidential health records exposed online on dozens of occasions. A recent investigation by The Guardian revealed that researchers with authorized access to the sensitive data appear to have inadvertently posted files containing patient information to public platforms.

The Biobank holds genome sequences, scans, blood samples, and lifestyle information, and has been instrumental in driving breakthroughs in research related to conditions like cancer, dementia, and diabetes. Even as the exposed files do not include names or addresses, they contain details like hospital diagnoses and dates of treatment, raising privacy concerns. The scale of these incidents, and the ease with which data could be re-identified, has prompted questions about the safeguarding of patient records.

How Data Was Exposed

The leaks appear to stem from a practice of researchers sharing code used to analyze the Biobank’s large datasets. As journals and funders increasingly require this code to be publicly available, some researchers have accidentally included portions or entire Biobank datasets when uploading their perform to platforms like GitHub, a popular code-sharing website. UK Biobank prohibits this type of data sharing and states it has implemented additional training for researchers to prevent future occurrences.

Between July and December 2025, UK Biobank issued 80 legal notices to GitHub, successfully requesting the removal of data. However, a significant amount of data remains accessible online, including files containing patient IDs, test results, and, in one instance discovered in January, hospital diagnoses and dates for approximately 413,000 participants, along with their sex and date of birth. The Guardian’s investigation highlighted the potential for re-identification, even with limited information.

Re-Identification Risks Demonstrated

To assess the risk, The Guardian worked with a Biobank volunteer who had undergone medical procedures. By providing the month and year of birth and details of a major surgery, the data scientist was able to pinpoint the volunteer’s extensive hospital diagnosis records within the exposed dataset. A data expert who reviewed one of the files described it as a “gross invasion of privacy,” noting the ease with which sensitive information could be accessed. “It sent shivers down my spine to even open,” they said, adding that they deleted the file immediately.

This raises concerns about the limitations of de-identification techniques. While names and addresses are removed, the combination of seemingly innocuous data points – like birth month and year, and details of medical events – can be enough to identify individuals, particularly in an age where information is readily available online and increasingly analyzable with artificial intelligence.

Biobank’s Response and Data Security Measures

UK Biobank maintains that no identifying data was provided to researchers and that the re-identification scenario tested by The Guardian does not represent a significant privacy risk without additional information. A spokesperson emphasized that the Biobank proactively searches GitHub, contacts researchers directly, and issues legal takedown notices, resulting in the removal of approximately 500 repositories. They likewise point to a disclaimer on their website reminding participants not to share health information publicly that could reveal their identity. More information on their data protection policies is available on the UK Biobank website.

However, experts question whether Biobank can fully regain control of the data released online. Despite takedown requests, files continue to be archived on websites dedicated to preserving code, making complete removal challenging.

The Tension Between Research and Privacy

Privacy experts suggest that UK Biobank’s approach may be unrealistic, given the prevalence of online information sharing. Professor Felix Ritchie, an economist at the University of the West of England, questioned whether the Biobank adequately considers that individuals routinely share health information online. “Are these people aware that the internet exists?” he asked. “The idea that they can rely on their volunteers never putting any other information out there about themselves is an entirely unreasonable thing to expect.”

Dr. Luc Rocher, associate professor at the Oxford Internet Institute, highlighted that removing direct identifiers doesn’t guarantee anonymity. Knowing a person’s birthday and the date of a medical event, for example, may be sufficient to pinpoint their record with a high degree of confidence. Once identified, that record could reveal highly sensitive information, such as psychiatric diagnoses or HIV test results.

Professor Niels Peek, professor of data science and healthcare improvement at the University of Cambridge, acknowledged that Biobank has taken the issue seriously and implemented reasonable measures. However, he emphasized the inherent tension between the ambition to drive health research with large-scale data and the ethical imperative to protect individual privacy. “The scale and persistence with which this has happened demonstrates that there are huge tensions,” he said.

What’s Next for Data Security at UK Biobank?

UK Biobank continues to refine its data security protocols, including enhanced training for researchers and proactive monitoring of online platforms. The organization is also investigating the specific incidents highlighted by The Guardian, but has stated it has found no evidence of misuse of the data. The incident underscores the ongoing challenges of balancing the benefits of large-scale health research with the need to protect patient privacy in an increasingly interconnected digital world. Further reviews of data access procedures and security protocols are likely, alongside continued vigilance in monitoring for and addressing data breaches.

Participants concerned about their data can find more information and contact UK Biobank directly through their website: https://www.ukbiobank.ac.uk/