"At least one of these three datasets appears to contain data from all 500,000 UK Biobank volunteers," he said.
Ian Murry confirms listings on Alibaba e-commerce platforms
In a statement to the House of Commons, the Minister for Digital Government and Data, Ian Murry, confirmed that personal health data belonging to UK Biobank volunteers was advertised for sale by several dealers on Alibaba e-commerce platforms in China. UK Biobank and the government say the listings have since been removed, and both organizations believe that nobody purchased the leaked data.
Scope of the exposed material: whole-body scans, DNA sequences and sensitive medical records
UK Biobank collects information used by thousands of scientific research papers. The material referenced in the listings includes whole-body scans, DNA sequences and other sensitive medical records drawn from the cohort of roughly 500,000 volunteers. UK Biobank stressed that the leaked files did not contain personal identification fields such as names, addresses, contact details, telephone numbers or NHS Numbers and described the records as de-identified.
How access was misused: researchers at three academic institutions
The organization traced the breach to researchers at three academic institutions who had misused their authorised access to UK Biobank data. Professor Sir Rory Collins, chief executive and principal investigator of UK Biobank, described the researchers' actions as a "clear breach" of the contract those institutions had signed. Both the individuals and their institutions have had their access to the project suspended.
Immediate technical and governance actions by UK Biobank
In response to the incident, UK Biobank temporarily suspended all access to its restricted, cloud-based research platform hosted in the UK. The organisation said it will impose strict limits on the number of files users can download and will take "further steps to enhance our systems to prevent this from happening again." UK Biobank also announced a board-led, "comprehensive and forensic" investigation into the incident.
What this means for UK Biobank volunteers, academic researchers, and the UK government
- UK Biobank volunteers: The organisation is emphasising that the data published in the listings were de-identified and did not include direct contact or identity fields; volunteers will be watching the outcome of the forensic investigation and any technical changes to the research platform.
- Academic researchers and institutions: Three institutions have had access suspended after their researchers were identified as having misused access; the incident underscores contractual controls over platform use and new download limits are being imposed.
- The UK government and Chinese actors (Alibaba and Chinese authorities): The government received notification via UK Biobank and reported that Alibaba removed the listings, with UK Biobank noting "rapid co-operation" from Chinese authorities and Alibaba; the government and UK Biobank currently believe there was no purchase of the data.
The episode lands at the intersection of large-scale biomedical research and data governance: a half-million-volunteer repository, research access controls, and commercial platforms abroad all figure in a matter now under a formal, forensic board inquiry. UK Biobank has suspended platform access, limited file downloads and begun a formal investigation; from here the organisation and its partners must show what technical changes, contractual enforcement and oversight will follow to restore trust among volunteers and researchers.