Medical Data Leaked: UK Biobank Under Fire

A Guardian investigation has revealed that confidential health data from UK Biobank, a flagship medical research project holding records for 500,000 British volunteers, has been exposed online on dozens of occasions. Scientists granted access to this sensitive information have apparently sometimes been careless with its security.

The files, which seem to have been unintentionally posted online by researchers, do not contain names or addresses but may still pose privacy risks. One dataset discovered contained millions of hospital diagnoses and dates for over 400,000 participants. Experts have described the scale and persistence of these leaks as "shocking."

UK Biobank has rejected these concerns, stating that no identifying data was given to researchers and that they have seen no evidence of participant re-identification. The organization, founded in 2003, holds genetic sequences, scans, and lifestyle information. It has recently faced issues with researchers accidentally publishing partial or entire datasets to GitHub when intending to upload analysis code.

In the past year, UK Biobank issued 80 legal notices to GitHub between July and December 2025 to remove data. Despite these efforts, much data remains accessible. Privacy experts noted that even without direct identifiers, information like birth dates and medical procedure dates could potentially be used to re-identify individuals, especially with advancing AI capabilities.