Private UK Biobank records from 500,000 volunteers were listed for sale on Alibaba, the government has confirmed.
The de-identified information, belonging to participants in the UK Biobank project, appeared in three separate listings, with at least one seeming to contain data from the full volunteer group.
De-identified means names, addresses and exact dates of birth were removed, but the data can still carry privacy risks.
The government said the listings were removed after UK officials worked with Alibaba and the Chinese government, and it is not believed any sales were made.
Technology minister Ian Murray told MPs that UK Biobank alerted the government on 20 April after finding the listings on Alibaba’s e-commerce platforms in China.
He said the charity had identified three listings that appeared to offer Biobank participation data for sale.
“At least one of these three datasets appeared to contain data from all 500,000 UK Biobank volunteers.
“I want to thank the Chinese government for the speed and seriousness with which they worked with us to help remove those listings and the ongoing work to remove any further listings.”
The latest breach comes after sensitive UK Biobank data was reportedly exposed online dozens of times last month, raising fresh questions about whether security has been too lax.
UK Biobank holds health data from 500,000 volunteers, including genome sequences, brain scans, blood samples and diagnostic records. Scientists at universities and private companies around the world can apply to access the resource.
Earlier this year, health secretary Wes Streeting issued a legal direction allowing the coded GP data of all volunteers to be shared with UK Biobank for the first time.
The data advertised on Alibaba was de-identified, meaning it did not include names, addresses or precise dates of birth. But this kind of data can still pose privacy risks.
Last month, the Guardian reported it had apparently re-identified a participant in another leaked UK Biobank dataset, which provided access to extensive hospital diagnosis records for that individual.
Murray said access had been revoked for the three research institutions identified as the source of the data, while UK Biobank had temporarily suspended all access to its datasets.
Since 2024, researchers have been required to analyse data through Biobank’s cloud-based research platform, which was introduced to strengthen security.
However, it is understood there has been no technical block preventing raw participant data from being downloaded.
UK Biobank has referred itself to the Information Commissioner’s Office.
Chi Onwurah, chair of the Commons science, innovation and technology committee, said the “incredibly serious” breach was another blow to public trust.
“It’s really coming to something if we’re having to rely on the Chinese government to keep our data secure.”
Felix Ritchie, an economist at the University of the West of England, said: “They have been irresponsible and it’s really sad because UK Biobank is a fantastic resource.
“I don’t think they’ve got a grip of it.
“The amazing thing today is that it is for sale on the public internet. I expect that there’s lots more information on the dark web. And once it’s out there, you can’t get rid of it.”
Rory Collins, chief executive and principal investigator of UK Biobank, said the organisation had acted quickly after the listings were identified.
He said: “We take the protection of participants’ data extremely seriously and do not tolerate any form of data misuse.
“With support from the UK government, Chinese authorities and Alibaba, three listings for de-identified data were swiftly removed before a sale was made.
“The actions of these individuals are a clear breach of the contract they signed with UK Biobank and they, along with their academic institutions, immediately had their access suspended.”
“We apologise for the concern this will cause and have already put in place technology, processes and a board-led review to stop this happening again.
“We have also taken our research platform offline while we add a further upgrade that helps prevent de-identified data being taken out of the platform.
We expect this to take three weeks. Our existing plans to implement an automated ‘airlock’ that checks files and data continues at pace.”
