Medical data of 500k Biobank volunteers listed for sale on Alibaba, UK minister reveals
- Reference: 1776947689
- News link: https://www.theregister.co.uk/2026/04/23/500k_biobank_volunteers_data_listed/
- Source link:
The organization confirmed the data on roughly half a million volunteers was anonymized, but could not guarantee it would be impossible to identify individuals if it fell into the wrong hands.
The revelation came from UK technology minister Ian Murray speaking in the House of Commons on Thursday, with his comments delivered at the same time as Biobank confirming the data mishap.
Updated to add at 1525 April 23:
Three Chinese research institutions have been banned from UK Biobank's platform after the data belonging to half a million volunteers was listed for sale on Chinese e-commerce site Alibaba.
UK Biobank is a charity that runs the eponymous research project. It describes itself as the custodian of the world's most comprehensive biomedical dataset that's used by medical researchers globally.
[1]
The charity confirmed to the UK government on April 20 that three separate listings of data, one of which contained data belonging to all 500,000 UK participants, were listed for sale online by an unknown source. The revelation came from UK technology minister Ian Murray addressing the House of Commons on Thursday, with his comments delivered at the same time as UK Biobank confirming the data mishap via its website.
[2]
[3]
Both Murray and UK Biobank said the data was anonymized, but could not be wholly certain that it couldn't be used to identify individuals if it ended up in the wrong hands. Investigations into the abuse of data are ongoing, but there is currently no evidence to suggest that the data was bought or downloaded. Murray said that the [4]Chinese government was heavily influential in supporting the takedown of the listings, as was Alibaba.
"I want to thank the Chinese government for the speed and seriousness with which they worked with us to help remove these listings and the ongoing work to remove any further listings," said Murray.
[5]
The tech minister added that although the three institutions from which the data was derived were Chinese, this fact alone makes no suggestions about the intent behind the data's listing.
UK Biobank revoked the accreditation of the three research institutions, meaning they can no longer access the charity's platform or its data, but other institutions, such as Yale University, have also previously had their access revoked for "a breach of data," Murray confirmed.
A root cause analysis remains ongoing, although the current thinking is that the three Chinese institutions downloaded the bulk UK Biobank dataset to local storage, and through means yet to be identified, the data was listed for sale on Alibaba.
[6]
In 2024, UK Biobank changed the way accredited institutions access volunteers' data. It previously handed bulk datasets to said institutions for research purposes, but changed access models to one where only UK Biobank stored the data, and accredited researchers were then given logins to access the UK Biobank platform. Researchers carried out their required data analysis on the UK Biobank platform and downloaded the results of that analysis, not the data that informed it.
"What the system also allowed you to do, although you were contractually as an accredited organization not supposed to do, is download the datasets," Murray told the Commons.
"We understand from UK Biobank that this is probably what happened here - those three institutions have downloaded the datasets themselves, and we are yet unclear about how those data sets have ended up on that website, but the UK Biobank and institutions and organizations attached to government are working through that at the moment."
UK Biobank's response
UK Biobank said that the data listed for sale contained no personally identifiable information, such as names of the volunteers, their addresses, phone numbers, or NHS numbers, and expressed its gratitude to the authorities that helped remove the listings.
The charity did not specify the types of data that were included, but Murray stated in the Commons that several markers were included in the listings:
Gender
Age
Month and year of birth
Assessment center data
Attendance dates
Socioeconomic status
Lifestyle habits
Measures from biological samples related to haematology, biology, and chemistry
Sleep, diet, work environment, mental health, and health outcomes data.
UK Biobank told the government that it could not be 100 percent sure that the data could be used to identify a volunteer, but it would require highly advanced interpretations of the data to do so.
In a [7]statement issued on Thursday, UK Biobank said it had introduced a number of security improvements in the wake of the findings. "We have temporarily suspended all access to the UK Biobank research platform, while we put in place a strict limit on the size of files that can be taken off the platform," said Professor Sir Rory Collins, CEO and principal investigator of UK Biobank.
"This measure will allow researchers to export the results of their research, while severely limiting their ability to take any de-identified participant data off the platform. In addition, all files exported from the research platform will be monitored daily for any suspicious behavior. These security measures will further minimize the potential for misuse of UK Biobank data. In addition, we will conduct a comprehensive and forensic board-led investigation of this incident.
"We are developing the world's first automated checking system able to prevent de-identified participant data from being taken off the UK Biobank research platform, without preventing the important research that is being done by thousands of scientists around the world. We intend to have this automated system in place around the end of this year."
UK Biobank launched its project in 2012, and the anonymized data it provides experts (institutions in Russia, Iran, and North Korea are banned) informs leading medical research into conditions such as dementia, cancer, Parkinson's disease, chronic pain, [8]COVID-19 immunity , and more.
Despite the "unacceptable abuse" of medical data in this case, the UK expects UK Biobank to be the world's leading provider of biomedical data for research institutions going forward.
The charity reported the incident to the UK government on April 20 and reported itself to the Information Commissioner's Office shortly after.
"People's medical data is highly sensitive information, not only do people expect it to be handled carefully and securely, organizations also have a responsibility under the law," an ICO spokesperson told The Register .
"UK Biobank has made us aware of an incident and we are making enquiries." The Register contacted Alibaba for more information. ®
Get our [9]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aepCIrS8WKKsZTkmZ48MoQAAAQ4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aepCIrS8WKKsZTkmZ48MoQAAAQ4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aepCIrS8WKKsZTkmZ48MoQAAAQ4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2026/04/21/ncsc_chinas_cyberattacks_uk/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aepCIrS8WKKsZTkmZ48MoQAAAQ4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aepCIrS8WKKsZTkmZ48MoQAAAQ4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.ukbiobank.ac.uk/news/a-message-to-our-participants-uk-biobank-data-security-update/
[8] https://www.theregister.com/2025/07/23/covid_brain_ageing_study/
[9] https://whitepapers.theregister.com/
Re: It already is in the wrong hands
The seller's not necessarily in China. Alibaba is analogous to eBay or Amazon; anyone can sell on the platform, irrespective of their location.
I don't know what's worse though - the fact that the data has been "let loose," or that it was collected in the first place.
Re: It already is in the wrong hands
The data is supposed to be collected from volunteers. It sounds very much like the outfit I corresponded with some time ago as a possible volunteer. I tried to get some sensible answers about control and access. I failed - in fact they stopped responding - and left it there. I am not surprised by this report.
Re: It already is in the wrong hands
The data is supposed to be collected from volunteers.
Not if that infamous "rogue programmer" who was responsible for harvesting WiFi SSIDs by Google StreetView all those years ago happened to be employed by this organisation at a crucial point
Re: It already is in the wrong hands
if it's not used for the purpose it was intended then it's already in the wrong hands without commenters having to blindly interpret the intentions of the party involved
Saw in a different report (BBC ? Sky ?) that's it's data that was supplied to a couple registered institutions / researchers, and they've already had their access revoked. Amazingly it initially sounds like it wasn't actually a hack, just someone being a very naughty boy*
* other genders / sexes are available
"they've already had their access revoked"
It should serve as a warning to the rest.
"their access revoked"
Access to what, I wonder? Their local branch of Woolworths? Open countryside? Air?
Re: "their access revoked"
The ANONYMISED database is available to bona fide researchers from bona fide institutions, but they have to jump through a lot of hoops to get access to it, like detailing their research plans. Even then, they only get access to the bits that are relevant to their proposal, so not necessarily the full set. Some of the data was originally collected about 20 years ago, although there have been updates in the intervening years with "bolt ons", such as genome sequencing of groups smaller in number than the 500,000. The culprit(s) should be traceable, or at least the culprit institution.
Surprise, surprise
Biobank signed contracts with 3 Chinese research institutions, who then duly ignored the contract, and tried to sell the data on. Not exactly jaw-dropping.
Biobank claims that the data contains nothing personally identifiable, including addresses and DOBs. That claim needs to be taken with a liberal quantity of salt. Back when I was in NHS data 'socioeconomic status' actually meant a postcode, which you could run through another database to get the socioeconomic status. The DB probably also contains a real DOB, to allow the scammer researcher to get the current age, rather than the age when the participant signed up.
Re: Surprise, surprise
SES is not usually defined by the full postcode, often just the first 4/5 digits (which will lead to some anomalies).
It is very hard to get requests for DOB past ethics applications these days since that level of precision is unnecessary (except possibly in neo-natal healthcare, which is not in this set). MOB & YOB more likely yes.
So a certain amount of fuzzing at several levels to make re-identification difficult, (but not necessarily impossible).
more info here
https://www.bbc.co.uk/news/articles/cpvxgl3n138o
Bullet dodged from my POV
I applied for the CIO role at Biobank but was rejected on the grounds that others were "more qualified". If "more qualified" means being completely blasé about allowing bulk download of confidential health data by dubious institutions as long as enough £/$/€/Yuan are proffered then I'm glad they found somebody better suited for the role.
My definition of dubious institutions includes all China based companies as they have a mandatory duty to provide undisclosable access to anything and everything that the CCP demands. To be fair to China, this also applies to other nation states that are similarly uninterested in the rule of law in this area such as Russia and the USA (the latter through the CLOUD act for anybody jibbing at my gratuitous poke at Uncle Sam).
It already is in the wrong hands
If it's in China, you could argue that it already is. Well, wrong hands certainly. Any worse than the Americans or any other government?