UK Biobank participants’ health data offered for sale on Alibaba; researchers banned
Three Alibaba listings offered UK Biobank research data, one apparently covering all 500,000 volunteers. Listings were removed and those responsible banned; sales remain unconfirmed. Participants can contact UK Biobank with concerns.
There is no software update for participants to install. If you or a parent took part and have concerns, contact UK Biobank’s Participant Resource Centre on 0800 0276 276, Monday to Friday, 9am–5pm UK time.
What’s happening
UK Biobank disclosed on 23 April that participant research data had been offered for sale through three listings on Alibaba platforms in China. The government said at least one listing appeared to cover all 500,000 volunteers. UK Biobank traced the data to three academic institutions and suspended access; it later confirmed bans on the institutions and individuals responsible. The charity said names, addresses, dates of birth and NHS numbers were excluded, although the minister cautioned that identification could not be ruled out completely. The listings were removed, and Alibaba reportedly believed no purchases had occurred. A June investigation called for stronger controls and faster participant notification. By its October progress update, UK Biobank reported external verification of its strengthened platform and deletion confirmations in over 90% of cases involving legitimately downloaded data. Complete removal of every copy has not been established. This is a data misuse incident with no software patch for participants.
- What
- Breach
- Affects
- UK Biobank participant health and research data
- Fixed in
- Nothing to patch
- Since
- 23 Apr 2026
- Closed
- 2 Oct 2026
Timeline
- Update
A progress page updated on this date said external experts had verified the strengthened research platform. In its wider cleanup of legitimately downloaded research data, UK Biobank had received deletion confirmations in over 90% of cases.
- Update
In a page updated on this date, UK Biobank reported additional platform protections, repeated external security tests and the appointment of a company to monitor the internet for threats.
- Update
The published oversight review found that participant notification had taken too long and recommended stronger security, access controls and deletion checks. UK Biobank confirmed that the responsible individuals and academic institutions had been banned.
- Update
UK Biobank sent participants a further apology and advance notice of the investigation report, promising to implement its recommendations.
- Update
The government confirmed that UK Biobank had referred itself to the Information Commissioner’s Office. Ministers asked the charity to contact all participants promptly.
- Made public
UK Biobank publicly disclosed the incident, saying the listings had been removed and it had been advised that no sales occurred. It suspended the three academic institutions and individuals involved, paused research-platform access and announced an investigation.
- UpdateNothing to patch
UK Biobank informed the UK government about three listings offering participant data on Alibaba platforms in China. At least one appeared to cover all 500,000 volunteers.
Sources
- A message to our participants: UK Biobank data security updateUK Biobank · 23 Apr 2026
- Minister of State statement to the House of Commons: 23 April 2026Department for Science, Innovation and Technology · 23 Apr 2026
- UK investigates after big health dataset listed for sale on China's AlibabaReuters · 23 Apr 2026
- Health data of 500,000 members of a UK project offered for sale online in ChinaAssociated Press · 23 Apr 2026
- A message to our participants: Data security update – June 2026UK Biobank · 3 June 2026
- Oversight Committee report into data security at UK Biobank publishedUK Biobank · 4 June 2026
- Preventing UK Biobank data from being downloadedUK Biobank · 22 Sept 2026
- Strengthening UK BiobankUK Biobank · 2 Oct 2026