UK Biobank — 500,000-volunteer dataset listed on Alibaba
De-identified data on 500,000 UK Biobank volunteers listed on Alibaba; trail traced to three Chinese research institutions previously granted bulk access.
- Target
- UK Biobank — 500,000-volunteer dataset listed on Alibaba
- Date public
- 23 April 2026
- Sector
- Healthcare
- Attack type
- Data Breach
- Threat actor
- Unattributed
- Severity
- High
- Region
- United Kingdom
In late April 2026, UK Biobank — the long-running national medical research charity — confirmed that de-identified data on approximately 500,000 of its UK volunteers had been listed for sale on the Alibaba marketplace on three separate occasions. One of the listings purported to contain the bulk dataset for all 500,000 participants. UK Biobank notified the UK government on 20 April; reporting broke publicly on 23 April.
The likely access path was not an external network intrusion. Three Chinese research institutions previously granted bulk access to the UK Biobank dataset for legitimate research purposes are believed to have downloaded the data to local storage, from which — by means UK Biobank has not publicly identified — copies reached Alibaba sellers. UK Biobank has banned the three institutions from its research platform. The Chinese government and Alibaba assisted in taking the listings down. There is no current evidence the data was bought or downloaded at scale.
UK Biobank temporarily suspended access to its research platform and introduced a strict file-size export limit, allowing researchers to take research results off the platform but severely limiting bulk participant-data extraction. The data was anonymised, but UK Biobank acknowledged it could not guarantee re-identification would be impossible if the dataset reached the wrong hands.
A deep-dive will follow once the access path is publicly identified, the institutional review traces the export trail, and the UK Information Commissioner’s Office has weighed in on the data-protection implications.