The UK Biobank temporarily paused access to its research platform after a breach, with the chief executive apologizing and pledging a full investigation and tighter security measures.

Access for three identified institutions has been revoked, data access is paused pending technical safeguards, and the platform is being upgraded to prevent de-identified data from being downloaded.

Biobank stressed that the data shown to researchers were de-identified and not personally identifying.

Officials said the dataset did not include names or contact details but could still pose a re-identification risk through factors like sex, age, birth details, socioeconomic status, lifestyle, and biological measures.

The breach involves data without direct identifiers, though officials warn re-identification could be possible with advanced methods.

Personal identifying information is removed before researchers access data, but non-identifying details remain that could be used to re-identify under very advanced techniques.

The breach raises national security and ethical concerns about health and genetic data potentially being used to pressure organizations or influence policy, according to MI5 and lawmakers.

This incident is described as a breach of trust rather than a classic cyberattack, since data were provided to researchers who then listed it for sale.

UK Biobank recruited participants between 2006 and 2010, aged 40 to 69, and its data have contributed to thousands of studies across health disciplines.

UK Biobank is a large, widely used dataset supporting dementia, cancer, and Parkinson’s research, integrating biological, health, and lifestyle information.

The data involved include de-identified genome sequences, brain scans, blood samples, and diagnostic records of participants.

Geopolitically, the data appearing on a Chinese platform is likely to sharpen UK-China discussions on tech and data-security policy.