"With support from both the U.K. and Chinese governments, Alibaba swiftly removed these listings, and we were advised that no sales had been made." — UK Biobank
What appeared on Alibaba
UK Biobank said a vendor listing on Alibaba, a Chinese e-commerce site, included de-identified participant data that the organization had earlier shared with researchers at three unnamed academic institutions. The U.K. dataset, which UK Biobank describes as a comprehensive collection of biological, health and lifestyle information, includes genomic data, health records, medical imaging data and "an array of other sensitive health information." UK Biobank told the government the material listed did not contain participants’ names, addresses, contact details or telephone numbers.
UK Biobank's containment measures
UK Biobank said it discovered the listing and notified the government on April 20. In an April 23 statement it said the listings had been found the week before. The organization suspended access for the three academic institutions and "the individuals involved" while it conducts a forensic investigation.
UK Biobank also said it instituted "a strict limit on the size of files that can be taken off the platform." The new control, the organization explained, will allow researchers to export research results but will limit their ability to download participant data. It reiterated that researchers are required to do their research on its "restricted, cloud-based research platform hosted in the U.K. data."
The U.K. government, Chinese officials, and Alibaba
British officials said the incident did not appear to involve a cyberattack. The U.K. government told reporters it is working with Chinese officials to remove the listings from Alibaba. UK Biobank reported that with support from both governments Alibaba removed the listings and that it had been "advised that no sales had been made."
Separately, The Guardian reported that additional health records had been listed on Alibaba and that officials are "braced" for the possibility of more leaks.
Reaction in the House of Lords
Parliamentary figures discussed the incident in the House of Lords. Conservative peer Nick Markham said that one of the data sets appeared to contain data from all 500,000 volunteers in the long-term study. Labour peer John Reid described the incident as not a cyberattack but warned that changing behavioral aspects alone would be insufficient.
Reid said, "it will require a range of cultural, behavioral and technical effects to try to minimize the chances of this happening again," emphasizing that a mix of remedies will be necessary if future exposure is to be prevented.
How researchers, volunteers, and the U.K. government are responding
- Researchers and academic institutions: Access for the three unnamed institutions and involved individuals has been suspended and their prior contractual permissions are being treated as breached, according to UK Biobank. The organization is limiting data exports and requiring use of its restricted, cloud-based research environment.
- Volunteers and participants: UK Biobank emphasized the listings contained de-identified information and did not include names, addresses, contact details or telephone numbers; however, one dataset was said by a member of the House of Lords to appear to include information tied to all 500,000 volunteers.
- The U.K. government and Chinese officials: The government notified and engaged Chinese counterparts to have the listings removed; Alibaba removed the listings and, per UK Biobank, was reported to have been advised that no sales had taken place.
This episode leaves several concrete steps in motion: a forensic investigation by UK Biobank, suspended access for implicated researchers and institutions, new technical limits on data export, and diplomatic engagement to take down online listings. The Guardian's reporting that additional records appeared on Alibaba and that officials are "braced" for more leaks frames the incident as ongoing rather than closed. The core factual ledger is therefore simple and stark — de-identified records from a major volunteer dataset were found listed for sale, the listings were removed with government assistance, access was suspended, and an investigation is underway.
