UK Biobank Data Exposed Online Nearly 200 Times — Half a Million Records Advertised

Confidential health and genetic records held by UK Biobank have been exposed online at least 198 times in the past year, according to a researcher who has tracked the charity's takedown notices. Roughly 503,000 volunteers' de-identified genetic profiles, medical histories and links to biological samples were among the material advertised, including a listing on Alibaba that has since been removed.

What Happened

UK Biobank — one of the world's largest repositories of biological, health and lifestyle data — issued almost 200 legal requests to remove unlawfully published datasets after files appeared on public platforms. Much of the exposed material appears to have been uploaded accidentally by researchers or shared informally between colleagues; a significant portion was discovered on code‑sharing sites such as GitHub. Officials say the Alibaba listing has been taken down and there is currently no evidence the data were purchased.

Scale and Content of the Data

The dataset represents information from participants who enrolled between 2006 and 2010, when they were aged 40–69. UK Biobank holds more than 15 million biological specimens and records that include urine, saliva and blood measurements, genomic data, hospital visit histories, occupation details and questionnaire responses covering sleep, diet, mental health and other outcomes. While direct identifiers such as names and addresses are not shared, the files can include age and month and year of birth — elements that can raise re‑identification risk when combined with other details.

Geographic Origins and Investigations

Of 198 incidents logged by Professor Luc Rocher (University of Oxford's Internet Institute), 75 have verified source locations. The United States accounted for the most traced uploads (at least 24), followed by China (21). Other confirmed origins include Hong Kong, the UK, Germany, South Korea, Qatar and the United Arab Emirates. UK Biobank has revoked access for three Chinese institutions linked to the Alibaba listing and has referred the incident to the Information Commissioner’s Office (ICO).

“It is still relatively easy to find UK Biobank files uploaded, often accidentally, by researchers around the world,” Professor Rocher said, warning that some published files contained genomic data and other highly sensitive health information.

Responses and Recommendations

UK government and data‑protection officials have expressed concern. The technology minister noted he could not be "100 per cent" certain that external actors could never identify individuals from the material, while the Government's National Data Guardian called for clear answers about what happened and how it will be prevented going forward. UK Biobank's chief executive apologised to participants and said the organisation takes data protection seriously, emphasising that shared datasets are de‑identified and that they have taken swift action.

Security experts and critics have urged practical safeguards, such as preventing bulk downloads of entire files, improving access controls, stricter auditing of who receives data, and clearer researcher guidance to avoid accidental public uploads. An earlier investigation showed that re‑identification can be possible using limited data points, underscoring the sensitivity of these datasets and the need for robust protections.

What participants should know: UK Biobank has taken down listings, revoked access for implicated institutions, issued numerous takedown notices and referred itself to the ICO. Investigations are ongoing and participants have been told they will be updated about the outcomes and any further measures.