Confidential health records from the United Kingdom’s flagship UK Biobank research project have been exposed online on multiple occasions, raising renewed concerns about how sensitive medical data from hundreds of thousands of volunteers is being safeguarded.

The incidents involve datasets derived from UK Biobank, a major biomedical research resource that contains detailed genetic, medical and lifestyle information from around five hundred thousand volunteers across Britain.

The database is widely used by scientists around the world and has contributed to major breakthroughs in the study of diseases such as cancer, dementia and diabetes.

Investigations found that researchers who had been granted authorised access to the data sometimes inadvertently uploaded sensitive datasets to public internet platforms while sharing code used for scientific analysis.

In several cases, files were posted on GitHub, a widely used code-sharing website, where they became accessible online before being discovered and removed.

Although the datasets did not contain direct identifiers such as names or home addresses, they included detailed health information such as hospital diagnoses, medical procedures and dates of treatment, alongside demographic details including sex and month and year of birth.

In one dataset uncovered online, millions of hospital diagnosis records covering more than four hundred thousand participants were present.

Experts warn that even when explicit identifiers are removed, such detailed medical information can still pose privacy risks.

When combined with other publicly available information, it may be possible to re-identify individuals and reveal sensitive aspects of their medical history.

Researchers testing the risk of re-identification found that in at least one case, a volunteer could be matched to records in the dataset using only limited information about their birth date and a past medical procedure.

The UK Biobank organisation says it has taken extensive steps to address the problem, including issuing legal takedown notices to online platforms and strengthening training requirements for researchers who access the data.

Between July and December two thousand twenty five alone, the project issued dozens of legal notices to remove data repositories that contained Biobank-derived information.

Officials involved in the project maintain that no participant has been confirmed as having been identified through these exposures.

They emphasise that researchers are strictly prohibited from sharing data outside secure systems and say the organisation actively monitors online platforms to detect and remove any unauthorised uploads.

Nevertheless, privacy specialists argue that the repeated nature of the incidents highlights the difficulty of controlling sensitive datasets once they are distributed to large numbers of researchers across the global scientific community.

Some experts say the persistence of the problem reflects broader tensions between the scientific push for transparency in research, such as requirements to publish code and data, and the ethical obligation to protect personal health information.

Founded in the early two thousands, UK Biobank has become one of the most influential health research platforms in the world.

Its vast dataset includes genetic sequences, blood samples, imaging scans and long-term medical records from participants who volunteered their information to help scientists better understand disease.

While many participants continue to support the project’s scientific mission, the exposure of confidential datasets has raised concerns about whether the safeguards surrounding such an unprecedented collection of personal health information can keep pace with the realities of modern digital research.