UK Biobank medical data belonging to around 500,000 volunteer participants has been discovered being offered for sale on Chinese e-commerce platforms, prompting urgent government intervention and a rapid security review of one of the world’s largest health research databases.

Technology Minister, Ian Murray told Parliament that UK Biobank, a non-profit health research charity, alerted the government on Monday after identifying multiple listings on Alibaba platforms advertising access to sensitive research datasets.

According to Ian Murray, UK Biobank is a long-running biomedical research resource containing health and lifestyle data voluntarily donated by hundreds of thousands of UK participants aged between 40 and 69 at the time of enrolment between 2006 and 2010. It has supported major medical breakthroughs, including research into cancer, dementia, Parkinson’s disease, cardiovascular conditions, and immunity responses to COVID-19.

The government confirmed that three separate listings were identified online, with at least one appearing to contain data covering the entire cohort of approximately 500,000 participants. Other listings reportedly offered assistance in accessing legitimate UK Biobank datasets or providing analytical services to researchers already granted access.

However, the government stressed that the data did not include directly identifying personal information.

“I want to reassure the House up front however, that Biobank have advised that this data did not contain participants’ names, addresses, contact details, or telephone numbers. The government has spoken to the vendor today and they do not believe that there were any purchases from the 3 listings before they were taken down.”
Ian Murray

Following the alert, UK Biobank, working with UK government and Chinese counterparts, moved to ensure the listings were taken down. The government also acknowledged the cooperation of Chinese authorities in assisting with the swift removal of the material.

A further step taken involved revoking access for the research institutions believed to be connected to the source of the data.

The Technology Secretary also confirmed that UK Biobank has temporarily suspended data downloads from its research platform while new technical safeguards are introduced and has also referred itself to the Information Commissioner’s Office.

According to the government, immediate steps include tightening controls on data exports, restricting file downloads to approved users, and implementing enhanced monitoring systems to detect suspicious activity. Participants will also be contacted directly by the organisation to inform them of the incident.

Ian Murray further reiterated that the data is only accessible to approved researchers under strict conditions and is intended to support public health advances, however, “it as an unacceptable misuse of trust and research infrastructure.”

Concerns Over Sensitive Health Data Exposure

The disclosure has sparked concern among policymakers and data protection experts over how large-scale health research datasets are accessed, shared, and safeguarded in international research environments.

UK government has clarified that the issue did not stem from a cyber-attack or external hacking incident, but rather from what was described as a legitimate download by an accredited organisation that was later misused.

According to UK Biobank, researchers from three universities received the files in question. Since then, access to these organisations has been blocked until an inquiry is conducted.

They added that, even though the listings were swiftly taken down, their existence on an internet marketplace constituted a violation of contracts pertaining to data use. In addition to implementing temporary steps, such as tighter restrictions on data extraction and daily export monitoring for questionable activity, it has initiated a thorough internal examination.

This occurrence was described by some MPs as a major breach of trust, while others questioned the consequences for international collaboration in scientific research. The responses in Parliament showed concern from both parties. However, the government has warned against politicising the matter, pointing out that thousands of foreign researchers are still using UK Biobank data in a secure and legal manner.

A spokesperson from the Information Commissioner’s Office indicated that, “People’s medical data is highly sensitive information, not only do people expect it to be handled carefully and securely, organisations also have a responsibility under the law,” adding, “UK Biobank has made us aware of an incident and we are making enquiries.”

UK Biobank has told participants that while the situation may cause concern, all data is de-identified and does not include directly identifiable personal details. It has reiterated that participants voluntarily consented to share their information for medical research purposes aimed at improving global health outcomes.

As investigations continue, the government has signalled that new guidance on data control in research environments will be issued in the coming weeks, alongside wider cybersecurity recommendations for organisations handling sensitive datasets.