Health data from UK Biobank listed for sale on Chinese website

Medical data from 500,000 participants was listed for sale on a Chinese website after a breach by researchers, UK Biobank confirmed. 

The biomedical database, established in 2003, contains in-depth genetic, lifestyle, and health data from UK volunteers, which is used to advance medical research.

In a statement, Professor Sir Rory Collins, chief executive and principal investigator of UK Biobank, said: “Last week, we found that de-identified participant data made available to researchers at three academic institutions were listed for sale on a consumer website in China, owned by Alibaba.

“With support from both the UK and Chinese governments, Alibaba swiftly removed those listings before any sales were made.

“This is a clear breach of the contract signed by these academic institutions and they, along with the individuals involved, have had their access suspended.”

He added that all the data are de-identified and do not contain any personally identifying information, such as names, addresses, dates of birth, and NHS numbers.

“Researchers are required to do their research on our restricted, cloud-based research platform hosted in the UK to prioritise the safe and secure use of your data.

“In light of this incident, we are taking further steps to enhance our systems to prevent this from happening again,” Collins said.

In the meantime UK Biobank has temporarily suspended all access to the UK Biobank research platform, while it puts in a strict limit on the size files that can be taken from the platform.

This will enable researchers to export the results of their research and limit their ability to take any de-identified participant data off the platform.

All files exported from the research platform will also be monitored daily for any suspicious behaviour.

“These security measures will further minimise the potential for misuse of UK Biobank data. In addition, we will conduct a comprehensive and forensic Board-led investigation of this incident,” Collins said.

UK Biobank is developing “the world’s first automated checking system”, which is expected to be in place around the end of 2026, to prevent de-identified participant data from being taken off the UK Biobank research platform, “without preventing the important research that is being done by thousands of scientists around the world”, Collins said.

In February, the government granted approval for UK Biobank researchers to access coded GP patient data for research purposes, which is expected to double the number of recorded cases of health conditions commonly handled by GPs.

Last month, UK Biobank confirmed that volunteers’ de-identified health data has been unintentionally published online by researchers on dozens of occasions.

Commenting on the breach, Dray Agha, senior manager of security operations at Huntress, said, “Health data was never just a privacy concern.

“It’s a high-value commodity in the global underground cybercrime economy.

“When datasets of this scale are advertised on mainstream e-commerce platforms, it signals a bold escalation in how threat actors monetise stolen sensitive information.”

Digital Health News contacted Alibaba and NHS England for comment.