Story perspectives

UK Biobank Data Briefly Listed on Alibaba, Now Removed

4/24/2026

Summary

Murray Flags Alibaba

20 April, Minister Ian Murray said UK Biobank data was listed on Alibaba in China.
The three listings held de-identified data on 500,000 participants, without names or NHS numbers.
Murray said the vendor believed no purchases were made and the UK, Chinese governments and Alibaba removed the listings.
Sir Rory Collins, chief executive of UK Biobank, said it halted platform access, suspended users, and apologized, assuring participants their data remains safe.

Summary

UK Biobank Blocks

In 2024 UK Biobank switched to a platform-only model that limits researchers to downloading analysis results.
A breach arose when three Chinese institutions downloaded full datasets, violating contracts and revealing a control weakness.
UK Biobank revoked the Chinese institutions’ access and had earlier suspended Yale’s accreditation after another breach.
Experts warn that security costs are an afterthought and urge more investment to safeguard large-scale biobank data.

History

Historical Context

The 2015 Office of Personnel Management breach, traced to hackers linked to China’s Jiangsu State Security Department and exposing 21.5 million federal personnel records, triggered worldwide reforms of government cyber-defense. In 2024, three Chinese-affiliated groups accessed UK Biobank data on Alibaba, prompting the NHS, Sir Rory Collins and Minister Ian Murray to accelerate security investments.

1 of 3

Murray Flags Alibaba

20 April, Minister Ian Murray said UK Biobank data was listed on Alibaba in China.
The three listings held de-identified data on 500,000 participants, without names or NHS numbers.
Murray said the vendor believed no purchases were made and the UK, Chinese governments and Alibaba removed the listings.
Sir Rory Collins, chief executive of UK Biobank, said it halted platform access, suspended users, and apologized, assuring participants their data remains safe.

1 / 3