Health Data of 500,000 Britons Found Listed for Sale on Alibaba

The British government has launched an investigation after the health records of half a million United Kingdom citizens were found listed for sale on Chinese e-commerce platform Alibaba, in what authorities have described as an unacceptable abuse of research data.

Technology Minister Ian Murray confirmed to lawmakers that UK Biobank, the world’s most comprehensive dataset of biological, health and lifestyle information compiled from volunteers, informed the government on April 20 that it had identified its data being advertised for sale by multiple sellers on Alibaba’s platforms in China. Three separate listings were identified, with at least one appearing to contain data from all 500,000 UK Biobank volunteers.

Murray told the House of Commons that the government took immediate action, working with UK Biobank, the Chinese government and Alibaba to ensure the three listings were removed. Access was also revoked for the three research institutions identified as the source of the data. He confirmed that the government had been told no purchases were made before the listings came down.

Current thinking among investigators is that the three Chinese institutions downloaded the bulk UK Biobank dataset to local storage, from where, through means yet to be identified, the data was listed for sale on Alibaba. A root cause analysis remains ongoing.

UK Biobank Chief Scientist Naomi Allen described those responsible as “rogue researchers” who were “giving the global scientific community a bad name,” and apologised to participants. Chief Executive Sir Rory Collins stated that the breach was a clear violation of the contracts the institutions had signed.

Both Murray and UK Biobank confirmed the data was anonymised, though neither could wholly guarantee it would be impossible to identify individuals if the data fell into the wrong hands. UK Biobank separately warned that participants who post genealogy information online could potentially be identified through cross-referencing.

The breach comes after UK security agency MI5 had previously raised concerns about Chinese researchers’ access to UK Biobank data, though the arrangement was nonetheless approved by the government at the time.

UK Biobank has temporarily suspended access to its research platform, introduced stricter limits on file exports and enhanced monitoring for suspicious activity while a board-led inquiry is conducted. The charity has also referred itself to the Information Commissioner’s Office.

Murray thanked the Chinese government for the speed with which it assisted in removing the listings.