UK Biobank health data of 500,000 volunteers listed for sale on Alibaba, government confirms

Lead

The UK government has confirmed that confidential health data belonging to half a million volunteers in the UK Biobank project was listed for sale on the Chinese e-commerce platform Alibaba. The listings, which appeared last week, were removed before any purchase was made, but the incident has prompted an emergency response and renewed scrutiny of data security practices.

Coverage Comparison

Reports from the BBC, Deutsche Welle, and The Guardian all confirm the core facts: datasets containing de-identified information about UK Biobank participants were posted for sale by three vendors on Alibaba. The listings were taken down swiftly, with no evidence that any data was sold. UK Biobank has temporarily suspended all access to its research platform as a precaution, and the three academic institutions involved have been banned from the platform.

While the BBC and Deutsche Welle focus on the government's response and the charity's actions, The Guardian has highlighted ongoing risks, reporting that additional listings have emerged since the initial breach was disclosed. The Guardian also noted the government's concern about the possibility of further leaks.

All sources agree that the data was "de-identified," meaning it did not include names, addresses, or precise dates of birth. However, experts warn that re-identification remains a real risk, especially as datasets grow and become more comprehensive.

Key Claims

• The UK Biobank, a charity holding health data from 500,000 volunteers, had datasets posted for sale on Alibaba by three academic institutions, according to multiple sources.
• The listings were removed before any purchase took place, as reported by the UK government and the BBC.
• UK Biobank suspended all access to its online research platform as a precautionary measure, according to its chief executive, Professor Sir Rory Collins.
• The three institutions involved—Second Xiangya Hospital, China-Japan Union Hospital, and Beijing Chaoyang Hospital—were banned from the platform, per Sir Rory's statement to the BBC.
• The government said the data did not include names, addresses, contact details, or telephone numbers, as reported by the BBC and Deutsche Welle.
• UK Biobank has faced previous data security incidents, as The Guardian reported, though no sales were made in this case.
• The Chinese government and Alibaba cooperated with UK authorities to remove the listings, according to UK technology minister Ian Murray.

perspectives

The incident has been framed primarily as a data security failure, with officials expressing anger and upset. Professor Sir Rory Collins, who is both the chief executive of UK Biobank and a participant, described himself as "angry" and "upset," and emphasized that the organization was acting to prevent recurrence.

Science minister Patrick Vallance called the breach a "real wake-up call" for researchers, acknowledging that even de-identified data carries re-identification risks, especially as techniques for triangulating information improve.

The Guardian has noted the broader context of previous data exposures and the need for stronger safeguards, while also highlighting the scientific achievements of UK Biobank, which has contributed to thousands of research papers and significant medical discoveries.

UK Biobank's contribution to medical research is undeniably valuable, but this incident underscores the tension between open data sharing and privacy protection—a challenge that will require continuous vigilance.

This article was compiled from multiple reporting sources. All facts are attributed as reported.