UK Biobank reopens after data leak prompts five-month security overhaul

September 8, 2026 at 04:00 PM3 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The UK Biobank will begin reopening to researchers this month after a nearly five-month shutdown triggered by an April data leak. An anonymous researcher alerted the biobank that sensitive participant data was listed for sale on Alibaba's Xianyu platform. The biobank cut off researcher access while it built new security infrastructure, and its internal investigation found three instances of data offered for sale online, all linked to institutions in China.

Key Facts

The UK Biobank holds genetic and biomedical data from 500,000 participants, including medical-imaging files, health history and lifestyle information.
The biobank's internal investigation, published on 4 June, found three instances of participant data offered for sale online, all linked to institutions in China.
Alibaba has implemented automated searches to remove listings that reference the UK Biobank.
In March 2026, The Guardian reported that UK Biobank data had been accidentally uploaded by researchers to the public code repository GitHub on dozens of occasions.
In 2023, hackers accessed sensitive data, including names, addresses and ancestry information, from millions of users of the consumer genetic-testing company 23andMe.

The Data Leak

On a Tuesday in mid-April, the UK Biobank received an email from an anonymous researcher who had discovered what appeared to be sensitive information from hundreds of thousands of participants for sale on Xianyu, an e-commerce website owned by Alibaba. With the help of Alibaba and the governments of the United Kingdom and China, the UK Biobank managed to get the listing removed. The incident spurred an internal investigation and led the biobank to cut off access for researchers while it built new infrastructure to secure its data. After nearly five months offline, the biobank has said it will begin to re-open to researchers this month.

Security Response

The UK Biobank's internal investigation, published on 4 June, found three instances in which participant data were offered for sale online, all linked to institutions in China. All the listings have been taken down and the UK Biobank has banned these institutions from further access. Alibaba has implemented automated searches to remove listings that reference the biobank. The UK Biobank and 23andMe have since reassessed their security protocols and made updates to their platforms to put stricter controls on access.

Broader Context

In March 2026, The Guardian reported that data from the UK Biobank had accidentally been uploaded by researchers onto the public code repository GitHub on dozens of occasions, and showed how the data could potentially be linked back to an individual study participant. In 2023, hackers accessed sensitive data, such as names, addresses and ancestry information, from millions of users of the consumer genetic-testing company 23andMe. The UK Biobank is one of several biobanks available to researchers globally, but researchers say it is particularly valuable because of its large number of participants and the volume and diversity of the data collected. Daniel MacArthur, a geneticist at the Garvan Institute of Medical Research in Sydney, Australia, said researchers have learned more about human biology from the UK Biobank than from any other single resource.