Loading story…
Additional confidential UK Biobank volunteer health records were posted on Alibaba-linked Chinese websites after an initial breach, prompting UK officials to warn that more leaks may follow and to work with Chinese authorities on takedowns. Science minister Patrick Vallance said three Chinese hospitals were understood to be behind the postings. The exposed information relates to the UK Biobank research database covering about 500,000 volunteers, and access to the dataset was temporarily suspended after the breach was disclosed, reportedly by an anonymous whistle-blower. Officials described the leaked records as de-identified, but warned that combining large datasets could still enable re-identification.
The disclosures intensified scrutiny of UK Biobank’s longstanding data-sharing arrangements with Chinese researchers. Earlier reporting found that 265 of 1,375 approved UK Biobank access applications came from China, and that Chinese researchers were permitted to apply for access to linked UK GP records through a controlled-access platform. Critics had already warned that health and genomic data could be strategically valuable for biotechnology, surveillance, and intelligence purposes, particularly given concerns over China’s national intelligence law. Separate reporting also pointed to at least 30 other UK Biobank-related breaches in a single month, including a dataset on 96,000 volunteers that was reportedly uploaded by a Yale University master’s student and remained online.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Separate reporting indicated there had been at least 30 other UK Biobank-related data breaches in the previous month. One exposed dataset covering 96,000 volunteers was said to have been accidentally uploaded by a Yale University master's student and remained online at the time of reporting.
Following disclosure of the breach, UK Biobank temporarily suspended all access to its data. Officials said the breach affected records tied to 500,000 volunteers.
An anonymous whistleblower reportedly first alerted UK Biobank to a breach involving confidential volunteer health records. The incident ultimately concerned data relating to 500,000 UK Biobank volunteers.
UK officials said further listings of confidential UK Biobank volunteer health records were posted on Alibaba after the initial breach became known, and they expected more leaks. The government said it was working with Chinese authorities to remove the postings and had identified three Chinese hospitals whose researchers were understood to be behind them.
Technology minister Ian Murray told MPs that medical information relating to 500,000 UK Biobank participants had been listed for sale online in China on Alibaba. UK Biobank said it was investigating and stated that exposed data did not include direct identifiers such as names, addresses, contact details, or phone numbers.
NHS England cleared UK Biobank’s processes, allowing approved researchers, including those from China, to apply for access to linked UK GP records for the 500,000-volunteer dataset. Access was to occur through UK Biobank’s controlled-access platform rather than by downloading copies of the data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourceinfosecurity-magazine.com
Open sourcebbc.co.uk
Open sourcethetimes.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
UK officials said de-identified health and biological data linked to about **500,000 UK Biobank volunteers** was advertised for sale in **three Alibaba listings**, prompting parliamentary disclosure and a public confirmation from the biomedical research repository. Authorities said the exposed records did not include direct identifiers such as names, addresses, or contact details, but warned that misuse could still create a risk of re-identification. The listings were removed after the UK government said it worked with UK Biobank, Alibaba, and Chinese authorities, and officials said they did not believe any data had been sold. The government said the exposed dataset appears to have originated from **legitimate downloads by accredited research institutions**, not from a direct intrusion into UK Biobank’s own systems. In response, UK Biobank revoked access for **three research institutions**, paused further data access, took its research platform offline for security upgrades, and referred itself to the **Information Commissioner’s Office**. The incident has intensified criticism of UK Biobank’s long-standing practice of allowing researchers to download datasets to local environments, with officials reportedly describing its security controls as lax.
Jun 29, 2026
De-identified medical and genomic data linked to up to **500,000** UK Biobank volunteers was advertised for sale in three listings on Alibaba, prompting a UK government response and an ongoing investigation. Officials said the exposure did not result from an external hack but from a legitimate download by accredited research institutions, with three institutions identified as the source of the postings. The exposed dataset reportedly included sensitive health, genetic, demographic, socioeconomic, and lifestyle information, raising concerns that individuals could still be re-identified when combined with other data. Alibaba and Chinese authorities removed the listings before any sales were confirmed, while UK Biobank revoked the institutions’ access, temporarily suspended wider access to its research platform, and referred itself to the UK Information Commissioner's Office.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026