Loading story…
De-identified medical and genomic data linked to up to 500,000 UK Biobank volunteers was advertised for sale in three listings on Alibaba, prompting a UK government response and an ongoing investigation. Officials said the exposure did not result from an external hack but from a legitimate download by accredited research institutions, with three institutions identified as the source of the postings.
The exposed dataset reportedly included sensitive health, genetic, demographic, socioeconomic, and lifestyle information, raising concerns that individuals could still be re-identified when combined with other data. Alibaba and Chinese authorities removed the listings before any sales were confirmed, while UK Biobank revoked the institutions’ access, temporarily suspended wider access to its research platform, and referred itself to the UK Information Commissioner's Office.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Following the discovery of UK Biobank data listings on Alibaba, the organization said it imposed stricter controls on data exports from its UK-hosted cloud research platform. The measure accompanied its forensic investigation and suspensions of the implicated institutions and individuals.
UK officials publicly disclosed the exposure and said an investigation was underway. UK Biobank also referred itself to the UK Information Commissioner's Office as scrutiny increased over foreign access to genomic data.
Alibaba and the Chinese government cooperated to remove the listings before any sales occurred. UK Biobank identified three institutions as the source of the postings, revoked their access, and temporarily suspended broader access to its research platform.
De-identified medical and genomic data from UK Biobank covering up to 500,000 British volunteers was found advertised for sale in three listings on Alibaba. UK officials said the exposure resulted from a legitimate download by accredited research institutions rather than an external hack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcetechrepublic.com
Open sourcescworld.com
Open sourcemalwarebytes.com
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
UK officials said de-identified health and biological data linked to about **500,000 UK Biobank volunteers** was advertised for sale in **three Alibaba listings**, prompting parliamentary disclosure and a public confirmation from the biomedical research repository. Authorities said the exposed records did not include direct identifiers such as names, addresses, or contact details, but warned that misuse could still create a risk of re-identification. The listings were removed after the UK government said it worked with UK Biobank, Alibaba, and Chinese authorities, and officials said they did not believe any data had been sold. The government said the exposed dataset appears to have originated from **legitimate downloads by accredited research institutions**, not from a direct intrusion into UK Biobank’s own systems. In response, UK Biobank revoked access for **three research institutions**, paused further data access, took its research platform offline for security upgrades, and referred itself to the **Information Commissioner’s Office**. The incident has intensified criticism of UK Biobank’s long-standing practice of allowing researchers to download datasets to local environments, with officials reportedly describing its security controls as lax.
Jun 29, 2026
Additional confidential UK Biobank volunteer health records were posted on Alibaba-linked Chinese websites after an initial breach, prompting UK officials to warn that more leaks may follow and to work with Chinese authorities on takedowns. Science minister Patrick Vallance said three Chinese hospitals were understood to be behind the postings. The exposed information relates to the **UK Biobank** research database covering about **500,000 volunteers**, and access to the dataset was temporarily suspended after the breach was disclosed, reportedly by an anonymous whistle-blower. Officials described the leaked records as de-identified, but warned that combining large datasets could still enable re-identification. The disclosures intensified scrutiny of UK Biobank’s longstanding data-sharing arrangements with Chinese researchers. Earlier reporting found that **265 of 1,375** approved UK Biobank access applications came from China, and that Chinese researchers were permitted to apply for access to linked UK GP records through a controlled-access platform. Critics had already warned that health and genomic data could be strategically valuable for biotechnology, surveillance, and intelligence purposes, particularly given concerns over China’s national intelligence law. Separate reporting also pointed to at least **30 other UK Biobank-related breaches** in a single month, including a dataset on **96,000 volunteers** that was reportedly uploaded by a Yale University master’s student and remained online.
Jun 29, 2026
A dark web seller has advertised a dataset allegedly containing personal information on about 15 million people in Kazakhstan, claiming the data was stolen from the country’s `eGov` platform. Reports said the archive was offered for roughly **0.5 bitcoin**—about **$32,000**—and was described as a **2.7 GB** file with **47 million rows**. The listing allegedly included passport details, phone numbers, email addresses, employment information, website passwords, and document scans, although key elements of that description have not been independently verified. Kazakhstan’s Ministry of Artificial Intelligence and Digital Development said it is examining the claim but has found **no confirmed evidence** so far that government e-services were breached or that the data originated directly from `eGov`. Officials said specialists are analyzing samples and cautioned that large databases sold online can be assembled from older leaks and multiple sources. The alleged sale comes after other major personal-data exposures in Kazakhstan, including a 2025 incident affecting more than 16 million records and another 2026 case involving a seized database, intensifying scrutiny of data protection as the country expands digital public services.
Aug 12, 2026