Breaches and incidentsBriefReported by a reputable outlet, citing the company
UK Biobank: de-identified data on about 500,000 participants found for sale on an Alibaba consumer site
UK Biobank said it found de-identified participant data offered for sale on a consumer website operated by Alibaba.
- Disclosed
What happened
- UK Biobank said it found de-identified participant data offered for sale on a consumer website operated by Alibaba; media reports put it at datasets for around half a million participants. The listings were removed with help from the Chinese and UK governments before any sale, per reports. In March, a Guardian investigation had found confidential health data exposed online on dozens of occasions, mostly via researchers sharing code and data on platforms such as GitHub.
- Root cause: not fully disclosed; data originates from the approved-researcher access model (how it reached the listing was not confirmed in the sources checked).
- Attacker: not identified.
- Response: listings removed; UK Biobank statement to participants.
Sources
- https://en.wikipedia.org/wiki/UK_Biobank
- https://www.ukbiobank.ac.uk/news/a-message-to-our-participants-uk-biobank-data-security-update/
- https://www.theguardian.com/technology/2026/apr/23/private-health-records-uk-biobank-chinese-website-alibaba
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.