Loading story…
UK officials said de-identified health and biological data linked to about 500,000 UK Biobank volunteers was advertised for sale in three Alibaba listings, prompting parliamentary disclosure and a public confirmation from the biomedical research repository. Authorities said the exposed records did not include direct identifiers such as names, addresses, or contact details, but warned that misuse could still create a risk of re-identification. The listings were removed after the UK government said it worked with UK Biobank, Alibaba, and Chinese authorities, and officials said they did not believe any data had been sold.
The government said the exposed dataset appears to have originated from legitimate downloads by accredited research institutions, not from a direct intrusion into UK Biobank’s own systems. In response, UK Biobank revoked access for three research institutions, paused further data access, took its research platform offline for security upgrades, and referred itself to the Information Commissioner’s Office. The incident has intensified criticism of UK Biobank’s long-standing practice of allowing researchers to download datasets to local environments, with officials reportedly describing its security controls as lax.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
In response to the exposure, UK Biobank revoked access for three research institutions, paused further data access, took its research platform offline for upgrades, and referred itself to the Information Commissioner's Office.
Three Alibaba listings offering the UK Biobank dataset were taken down after the UK government worked with UK Biobank, Alibaba, and the Chinese government. Authorities said they did not believe any sale had taken place before removal.
UK Technology Minister Ian Murray said the government was informed on 2026-04-29 that de-identified UK Biobank data tied to about 500,000 volunteers had been advertised for sale online. Officials later said the data appeared to have come from legitimate researcher downloads rather than an external intrusion.
Ian Murray disclosed in the House of Commons that de-identified health and biological data relating to roughly 500,000 UK Biobank volunteers had been offered for sale on Alibaba. UK Biobank simultaneously confirmed the incident and acknowledged re-identification risks if the data were misused.
On 2026-04-21, reporting revealed that a Discord-linked private forum had obtained unauthorized access to Anthropic's Mythos Preview. Anthropic publicly confirmed it was investigating and said it had found no evidence that its internal systems were affected.
On the same day Mythos was announced, a small unauthorized group allegedly gained access through a third-party vendor environment using shared contractor access, API keys, and inferred model URL patterns. Reporting said the group continued using the model after obtaining access.
Anthropic announced Claude Mythos Preview on 2026-04-07 as a tightly controlled cybersecurity-focused AI model made available only to a limited group of partners because of concerns it could be weaponized if broadly released.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcedatabreaches.net
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourceeuronews.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
De-identified medical and genomic data linked to up to **500,000** UK Biobank volunteers was advertised for sale in three listings on Alibaba, prompting a UK government response and an ongoing investigation. Officials said the exposure did not result from an external hack but from a legitimate download by accredited research institutions, with three institutions identified as the source of the postings. The exposed dataset reportedly included sensitive health, genetic, demographic, socioeconomic, and lifestyle information, raising concerns that individuals could still be re-identified when combined with other data. Alibaba and Chinese authorities removed the listings before any sales were confirmed, while UK Biobank revoked the institutions’ access, temporarily suspended wider access to its research platform, and referred itself to the UK Information Commissioner's Office.
Jun 29, 2026
Additional confidential UK Biobank volunteer health records were posted on Alibaba-linked Chinese websites after an initial breach, prompting UK officials to warn that more leaks may follow and to work with Chinese authorities on takedowns. Science minister Patrick Vallance said three Chinese hospitals were understood to be behind the postings. The exposed information relates to the **UK Biobank** research database covering about **500,000 volunteers**, and access to the dataset was temporarily suspended after the breach was disclosed, reportedly by an anonymous whistle-blower. Officials described the leaked records as de-identified, but warned that combining large datasets could still enable re-identification. The disclosures intensified scrutiny of UK Biobank’s longstanding data-sharing arrangements with Chinese researchers. Earlier reporting found that **265 of 1,375** approved UK Biobank access applications came from China, and that Chinese researchers were permitted to apply for access to linked UK GP records through a controlled-access platform. Critics had already warned that health and genomic data could be strategically valuable for biotechnology, surveillance, and intelligence purposes, particularly given concerns over China’s national intelligence law. Separate reporting also pointed to at least **30 other UK Biobank-related breaches** in a single month, including a dataset on **96,000 volunteers** that was reportedly uploaded by a Yale University master’s student and remained online.
Jun 29, 2026
A dark web seller has advertised a dataset allegedly containing personal information on about 15 million people in Kazakhstan, claiming the data was stolen from the country’s `eGov` platform. Reports said the archive was offered for roughly **0.5 bitcoin**—about **$32,000**—and was described as a **2.7 GB** file with **47 million rows**. The listing allegedly included passport details, phone numbers, email addresses, employment information, website passwords, and document scans, although key elements of that description have not been independently verified. Kazakhstan’s Ministry of Artificial Intelligence and Digital Development said it is examining the claim but has found **no confirmed evidence** so far that government e-services were breached or that the data originated directly from `eGov`. Officials said specialists are analyzing samples and cautioned that large databases sold online can be assembled from older leaks and multiple sources. The alleged sale comes after other major personal-data exposures in Kazakhstan, including a 2025 incident affecting more than 16 million records and another 2026 case involving a seized database, intensifying scrutiny of data protection as the country expands digital public services.
Aug 12, 2026