UK Biobank data on 500,000 volunteers listed for sale on Alibaba

On 23 April 2026, UK technology minister Ian Murray told the House of Commons that data from UK Biobank, the charity-run research resource holding health and genetic information on around half a million British volunteers, had been offered for sale online in China. UK Biobank had alerted the government on 20 April after identifying listings by several sellers on Alibaba's e-commerce platforms.

Three listings appeared to sell UK Biobank participant data, and at least one dataset appeared to cover all 500,000 participants. Other listings offered unauthorised help with accessing and analysing the data. With support from the UK and Chinese governments, Alibaba removed the listings before any sales were made.

How the data got out

This was not an external hack. The data was released by three academic institutions that had legitimate access to UK Biobank for research and that broke their contracts by making it available for commercial sale. The datasets were de-identified: they did not include names, addresses, contact details or telephone numbers, but could include attributes such as gender, age and month and year of birth alongside health information.

UK Biobank suspended access for the institutions and individuals involved, temporarily halted access to its research platform for all users, imposed strict limits on the size of files that can be exported, and began a forensic investigation.

Why it matters

UK Biobank is one of the world's most widely used biomedical datasets, built on volunteers' trust that their records will only be used for approved health research. Even without names, rich health and genetic records combined with age, sex and birth dates raise re-identification concerns. The incident shows that research-access controls and contractual safeguards, not just perimeter security, decide whether sensitive datasets stay protected.