UK Biobank health data of 500,000 participants offered for sale online in China; Alibaba listings reported

An Information Commissioner's Office spokesperson stressed that people’s medical data are highly sensitive and that organisations have a responsibility under the law. The ICO said UK Biobank had informed the ICO and that enquiries would be made.

Sir Rory Collins, Chief Executive of UK Biobank, told volunteers that the data involved had been made available to researchers at three institutions and described the appearance on Alibaba as a clear breach of contract. In response, access to the UK Biobank research platform was temporarily suspended, a strict limit was imposed on the size of files that can be removed, daily monitoring of file exports was introduced, and a comprehensive board-led investigation was announced.

The listings on Alibaba were taken down following cooperation from the UK and Chinese governments, and the government said that no purchases were made from the three listings.

The government confirmed that information from all UK Biobank members was found listed for sale on Alibaba. The data were described as de-identified and did not include names, addresses, contact details or telephone numbers. The dataset could include gender, age, month and year of birth, socioeconomic status, lifestyle habits, and measures from biological samples. The article notes participants were recruited between 2006 and 2010 and were aged 40 to 69 at recruitment.

The charity that runs UK Biobank told the UK government about the data breach on Monday, April 20, 2026.