UK Biobank Breach Exposes Global Health Data Risks

Stolen UK health data has exposed a stark dilemma: the same information that risks privacy breaches could also power the next generation of life-saving drugs.

A clinician collects a blood sample from a volunteer, illustrating how large-scale health studies rely on patient contributions to build datasets used in medical research. Photo: Christopher Furlong/Getty Images

Data is valuable, and health data even more so. The global pharmaceutical industry has seen significant growth over the past two decades, with revenues reaching about $1.7tn in 2024. When it emerged that 500,000 files from the UK Biobank had been stolen in a data breach, many feared that their personal health information could be exposed. The data was later found for sale on Alibaba, the Chinese online marketplace.

The UK Biobank is a long-term scientific project and charity in the United Kingdom that holds de-identified biological samples and health-related data from half a million people. Volunteer participants aged 40 to 69 were recruited between 2006 and 2010 from across Britain. They consented to share their health data and to be followed for at least 30 years, with the aim of enabling scientific discoveries in the prevention, diagnosis and treatment of disease. It is the most comprehensive database of its kind and can be accessed by scientists around the world, provided their research is deemed to be in the public interest. Data from the Biobank has been used in more than 18,000 peer-reviewed scientific papers.

Although the dataset was de-identified and did not include names or contact details, it contained highly sensitive information such as genetic, medical and lifestyle data, which experts warn could still pose re-identification risks. The listings were removed by the Chinese government before any purchases were confirmed, and access for three research institutions in China that had legitimately downloaded the data was revoked. However, the breach has been widely criticized as a serious violation of trust.

https://twitter.com/louismosley/status/2048392054636515700?s=20

China's Continued Ambition

Many countries in Europe have begun implementing digital patient files that collect valuable health information. Countries such as Germany have adopted an opt-out system, meaning people are automatically enrolled unless they explicitly decline. The theft and attempted sale of UK data highlights both the value and the danger of such information, as well as the vulnerability of its storage.

The data stored in these databases has enormous potential for drug development and disease detection. It costs billions to discover new drugs, while billions more can be earned from selling them, making the industry both lucrative and altruistic. And yet, the costs of trials have never been higher, and there has been a recent trend to move them from the US to Australia, Asia, and China. This shift has been mainly due to tighter regulations and budget cuts in the US. China has expanded clinical trial activity and is now competing more closely with the US in the pharmaceutical and biotechnology sectors.

China has not only increased the number of clinical trials but is also testing novel medications, now overtaking leading US pharmaceutical companies in some areas. Moving beyond the production of affordable generics, it has expanded into complex personalized treatments, such as CAR T-cell therapies for cancer and hard-to-treat autoimmune diseases. This shift began already in 2016, when China launched a $9bn 15-year research and development plan. By comparison, the US National Institutes of Health received about $215m during the Obama administration, highlighting how China has sought to close the gap between the two countries.

Source: Barwick et al. (2026) based on Citeline TrialTrove Database

Who Owns The Data That Could Save Millions?

China could not have achieved these impressive aims without relying on a vast global network of hackers and spies. This has caused billions of dollars in losses through intellectual property theft. The US may also engage in industrial espionage, but the question is to what end and why. The two countries have different objectives in the pharmaceutical industry. China often prioritizes more purely capitalist goals, such as market share and innovation, while the US tends to prioritize security objectives.

It is not surprising that data such as the UK Biobank hack has attracted interest abroad, especially in China. Although such data carries a significant risk of misuse, its potential for drug development and disease research should not be dismissed. There is a clear unmet need for treatments for incurable and rare diseases. China is expected to become the first country in the world to approve a drug designed entirely with AI in 2026, marking a seismic shift in technology. Yet the country still struggles to translate its strengths in drug development into globally marketable products, perhaps because of its reputation.

The main issue is how this data should be accessed, not whether it should be accessed, as Louis Mosley, the CEO of data company Palantir UK has argued. Researchers and pharmaceutical companies need access to data to develop drugs and detect diseases. Although Palantir is better known for its work in defense, they also handle the UK’s National Health Service database, meaning Mosley is acutely aware of both its dangers and its immense potential. The question is how this can be balanced ethically, with informed patient consent, to advance medicine and help millions of people worldwide.