UK Biobank

Profile narrative

UK Biobank operates as a United Kingdom‑based charity that curates and provides access to de‑identified health information collected from a cohort of 500,000 volunteers. The dataset includes gender, age, month and year of birth, socioeconomic status, lifestyle habits and biological sample measures, while explicitly excluding names, addresses, contact details and NHS numbers. Legitimate research organisations are granted access to this resource through a dedicated platform, enabling scientific studies that rely on large‑scale biomedical data. In April 2026 the charity disclosed that portions of this de‑identified information had appeared for sale on Alibaba’s Taobao marketplace, a breach traced to approved research users rather than a cyber‑attack. Following the discovery, UK Biobank immediately revoked access for the implicated groups, paused platform availability, imposed stricter file‑size limits and instituted daily export monitoring.

A board‑led investigation was launched to assess the full scope of the exposure, and officials confirmed that no purchases of the listed data were recorded. The organisation acknowledged that even de‑identified details carry re‑identification risks and could undermine public trust in health‑data initiatives. Its governance structure includes a board with authority to direct investigative and remedial actions, reflecting a charitable governance model rather than commercial ownership. The incident prompted a comprehensive review of access controls and monitoring protocols to prevent future misuse of volunteer data. The charity's core function centres on enabling biomedical research while safeguarding participant privacy through de‑identification and controlled access mechanisms.

Incidents

1 incident linked to this organisation.