Alarm as UK Biobank data on 500,000 people put up for sale on Chinese website

Data belonging to 500,000 UK Biobank volunteers has been listed for sale online in China, prompting a government investigation and an urgent security response from the research charity.

Technology minister Ian Murray told MPs that three listings had been identified on a Chinese e-commerce platform, understood to be Alibaba, offering access to data linked to UK Biobank participants. At least one listing was said to contain information relating to the charity’s entire cohort of half a million volunteers, the Independent reported.

He described the incident as an “unacceptable abuse” of data and said the listings were removed before any confirmed purchases were made.

UK Biobank is one of the world’s largest and most widely used biomedical datasets, supporting research into conditions including cancer, dementia and Parkinson’s disease. It has been used by scientists internationally since opening to research access in 2012.

Mr Murray told the Commons that the data did not include names, addresses or contact details. However, he said it could include information such as age, sex, month and year of birth, socioeconomic background, lifestyle factors and biological measurements.

While stressing that individuals would be difficult to identify, he conceded he could not give “a complete guarantee” that re-identification would be impossible, albeit only through highly advanced methods.

He said the Government had worked with UK Biobank, the Chinese authorities and the platform operator to ensure the listings were taken down, and thanked Beijing for its cooperation.

The minister also confirmed that UK Biobank had revoked access for three research institutions linked to the incident and had paused further data access while new technical safeguards are introduced to prevent unauthorised downloads.

UK Biobank has referred itself to the Information Commissioner’s Office, the UK’s data protection regulator, as part of a formal investigation into the breach.

In a statement, Professor Sir Rory Collins, chief executive of UK Biobank, said participants’ personally identifying information remained secure and emphasised that the data offered for sale did not contain direct identifiers.

He said the organisation was “deeply sorry” for the concern caused and stressed that it was implementing additional security measures.

Sir Rory added that the dataset had already underpinned thousands of scientific studies since its creation, contributing to advances in the understanding and treatment of major diseases.

The incident has raised renewed concerns over the security of large-scale health datasets used in international research collaborations, particularly as such resources become increasingly valuable targets for commercial and state-linked actors.