{"id":"uk-biobank-data-sale-apr-2026","category":"breach","status":"closed","title":"UK Biobank participants’ health data offered for sale on Alibaba; researchers banned","tldr":"Three Alibaba listings offered UK Biobank research data, one apparently covering all 500,000 volunteers. Listings were removed and those responsible banned; sales remain unconfirmed. Participants can contact UK Biobank with concerns.","summary":"UK Biobank disclosed on 23 April that participant research data had been offered for sale through three listings on Alibaba platforms in China. The government said at least one listing appeared to cover all 500,000 volunteers. UK Biobank traced the data to three academic institutions and suspended access; it later confirmed bans on the institutions and individuals responsible. The charity said names, addresses, dates of birth and NHS numbers were excluded, although the minister cautioned that identification could not be ruled out completely. The listings were removed, and Alibaba reportedly believed no purchases had occurred. A June investigation called for stronger controls and faster participant notification. By its October progress update, UK Biobank reported external verification of its strengthened platform and deletion confirmations in over 90% of cases involving legitimately downloaded data. Complete removal of every copy has not been established. This is a data misuse incident with no software patch for participants.","action":"There is no software update for participants to install. If you or a parent took part and have concerns, contact UK Biobank’s Participant Resource Centre on 0800 0276 276, Monday to Friday, 9am–5pm UK time.","product":"UK Biobank participant health and research data","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["uk-biobank","alibaba","data-breach","health-data","privacy"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"A message to our participants: UK Biobank data security update","url":"https://www.ukbiobank.ac.uk/news/a-message-to-our-participants-uk-biobank-data-security-update/","by":"UK Biobank","date":"2026-04-23"},{"kind":"post","title":"Minister of State statement to the House of Commons: 23 April 2026","url":"https://www.gov.uk/government/speeches/minister-of-state-statement-to-the-house-of-commons-23-april-2026","by":"Department for Science, Innovation and Technology","date":"2026-04-23"},{"kind":"news","title":"UK investigates after big health dataset listed for sale on China's Alibaba","url":"https://www.lse.co.uk/news/uk-investigates-after-big-health-dataset-listed-for-sale-on-chinas-alibaba-z09fzfy3my5b0kd.html","by":"Reuters","date":"2026-04-23"},{"kind":"news","title":"Health data of 500,000 members of a UK project offered for sale online in China","url":"https://apnews.com/article/adc0585cebc36e988654a8a2c94f17e0","by":"Associated Press","date":"2026-04-23"},{"kind":"advisory","title":"A message to our participants: Data security update – June 2026","url":"https://www.ukbiobank.ac.uk/taking-part/stay-up-to-date/a-message-to-our-participants-data-security-update-june-2026/","by":"UK Biobank","date":"2026-06-03"},{"kind":"advisory","title":"Oversight Committee report into data security at UK Biobank published","url":"https://www.ukbiobank.ac.uk/news/report-into-data-security-at-uk-biobank-published/","by":"UK Biobank","date":"2026-06-04"},{"kind":"advisory","title":"Preventing UK Biobank data from being downloaded","url":"https://www.ukbiobank.ac.uk/about-our-data/protecting-the-data/strengthening-uk-biobank/preventing-uk-biobank-data-from-being-downloaded/","by":"UK Biobank","date":"2026-09-22"},{"kind":"advisory","title":"Strengthening UK Biobank","url":"https://www.ukbiobank.ac.uk/about-our-data/protecting-the-data/strengthening-uk-biobank/","by":"UK Biobank","date":"2026-10-02"}],"started":"2026-04-23","closed":"2026-10-02","created":"2026-11-03T21:01:52.804Z","updated":"2026-11-03T21:01:52.804Z","cve_notes":[],"timeline":[{"at":"2026-10-02","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"A progress page updated on this date said external experts had verified the strengthened research platform. In its wider cleanup of legitimately downloaded research data, UK Biobank had received deletion confirmations in over 90% of cases.","url":"https://www.ukbiobank.ac.uk/about-our-data/protecting-the-data/strengthening-uk-biobank/","by":"UK Biobank","patch":null},{"at":"2026-09-22","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"In a page updated on this date, UK Biobank reported additional platform protections, repeated external security tests and the appointment of a company to monitor the internet for threats.","url":"https://www.ukbiobank.ac.uk/about-our-data/protecting-the-data/strengthening-uk-biobank/preventing-uk-biobank-data-from-being-downloaded/","by":"UK Biobank","patch":null},{"at":"2026-06-04","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"The published oversight review found that participant notification had taken too long and recommended stronger security, access controls and deletion checks. UK Biobank confirmed that the responsible individuals and academic institutions had been banned.","url":"https://www.ukbiobank.ac.uk/news/report-into-data-security-at-uk-biobank-published/","by":"UK Biobank","patch":null},{"at":"2026-06-03","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"UK Biobank sent participants a further apology and advance notice of the investigation report, promising to implement its recommendations.","url":"https://www.ukbiobank.ac.uk/taking-part/stay-up-to-date/a-message-to-our-participants-data-security-update-june-2026/","by":"UK Biobank","patch":null},{"at":"2026-04-23","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"The government confirmed that UK Biobank had referred itself to the Information Commissioner’s Office. Ministers asked the charity to contact all participants promptly.","url":"https://www.gov.uk/government/speeches/minister-of-state-statement-to-the-house-of-commons-23-april-2026","by":"Department for Science, Innovation and Technology","patch":null},{"at":"2026-04-23","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"UK Biobank publicly disclosed the incident, saying the listings had been removed and it had been advised that no sales occurred. It suspended the three academic institutions and individuals involved, paused research-platform access and announced an investigation.","url":"https://www.ukbiobank.ac.uk/news/a-message-to-our-participants-uk-biobank-data-security-update/","by":"UK Biobank","patch":null},{"at":"2026-04-20","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"UK Biobank informed the UK government about three listings offering participant data on Alibaba platforms in China. At least one appeared to cover all 500,000 volunteers.","url":"https://www.gov.uk/government/speeches/minister-of-state-statement-to-the-house-of-commons-23-april-2026","by":"Department for Science, Innovation and Technology","patch":"na"}],"url":"https://hard.fyi/live/uk-biobank-data-sale-apr-2026/","json":"https://hard.fyi/api/live?id=uk-biobank-data-sale-apr-2026"}