UK Biobank data listed for sale on Chinese platforms

According to multiple reports, data from the UK Biobank was listed for sale on Alibaba by three Chinese research institutions. The data had been legitimately downloaded by the institutions before being listed, but the listings were removed before any sales were made. The UK Biobank charity informed the government about the listings, prompting an investigation. Technology minister Ian Murray described the leak as an 'unacceptable abuse' and told Parliament that at least three listings appeared, one containing data from all 500,000 volunteers.

The exposed data did not include names, addresses, or contact details, but included gender, age, month and year of birth, assessment centre data, attendance data, socioeconomic status, and lifestyle habits. The Guardian reported that one dataset contained millions of hospital diagnoses and associated dates for more than 400,000 participants. The Guardian was able to pinpoint a volunteer's hospital diagnosis records using only month and year of birth and details of a major surgery, raising concerns about re-identification. However, UK Biobank rejected privacy concerns, stating no identifying data was provided to researchers. Prof Sir Rory Collins, principal investigator of UK Biobank, said there is no evidence of any UK Biobank participant being re-identified by others. The minister could not give a complete guarantee that nobody could be identified from the data.

A Guardian investigation revealed that confidential health data from UK Biobank has been exposed online on dozens of occasions. Until late 2024, researchers were free to download data directly onto their own computer systems. Data was inadvertently published on GitHub when researchers uploaded code along with partial or entire Biobank datasets. UK Biobank issued 80 legal notices to GitHub between July and December 2025 to remove data. In response, UK Biobank has introduced further training for all researchers and is proactively searching for leaked repositories.

The database can be accessed by researchers worldwide with a sign-up fee of £3,000 a year. The breach originated from research organisations granted legitimate access, not a hacker group, according to the UK government. Access by those research groups has been revoked. The Guardian reported that one in five data access requests came from Chinese research groups, sparking a warning from MI5. A pause has been placed on access to the Biobank while a technical solution is implemented, according to Ian Murray.

According to Daily Mail - Home, a Whitehall source described the charity as having been 'very, very lax' over data access. Shadow national security minister Alicia Kearns said Labour had handed a 'gift to China'. The minister thanked the Chinese government for their cooperation in removing the listings. The UK Biobank is a registered charity that holds medical records of 500,000 British volunteers.

UK Biobank has paused global access to its data. The charity stated that no identifying data was provided to researchers and that there is no evidence of re-identification. The government investigation is ongoing, and further measures are expected to prevent future breaches.