A message to our participants: UK Biobank data security update

Published:

23 April 2026

A message from Professor Sir Rory Collins, Chief Executive and Principal Investigator of UK Biobank

Dear UK Biobank participant,

We would like to inform you about an incident involving UK Biobank data. We apologise to our participants for the concern this will cause, and we hope to provide reassurance by outlining the serious actions we are taking in response. 

Since UK Biobank started to make your de-identified data available for research in 2012, it has led to thousands of discoveries that are already leading to improvements in the prevention and treatment of many different diseases.

We take the protection of your data extremely seriously. Researchers have to go through our rigorous access review process, and their institutions sign a contract committing to keep the data secure, before we make the data available to them for research. Even though we only ever share de-identified data and have no evidence of any of you being identified unwillingly, we don’t want any use by anyone who has not been approved for access.

Last week, we found that de-identified participant data made available to researchers at three academic institutions were listed for sale on a consumer website in China, owned by Alibaba. With support from both the UK and Chinese governments, Alibaba swiftly removed these listings, and we were advised that no sales had been made. This is a clear breach of the contract signed by these academic institutions and they, along with the individuals involved, have had their access suspended.

Researchers are required to do their research on our restricted, cloud-based research platform hosted in the UK to prioritise the safe and secure use of your data. In light of this incident, we are taking further steps to enhance our systems to prevent this from happening again.

We have temporarily suspended all access to the UK Biobank research platform, while we put in place a strict limit on the size of files that can be taken off the platform. This measure will allow researchers to export the results of their research, while severely limiting their ability to take any de-identified participant data off the platform. In addition, all files exported from the research platform will be monitored daily for any suspicious behaviour. These security measures will further minimise the potential for misuse of UK Biobank data. In addition, we will conduct a comprehensive and forensic Board-led investigation of this incident.

We are developing the world’s first automated checking system able to prevent de-identified participant data from being taken off the UK Biobank research platform, without preventing the important research that is being done by thousands of scientists around the world. We intend to have this automated system in place around the end of this year.

We are grateful to the UK Government for their support in this matter, as well as the rapid co-operation from the Chinese authorities and Alibaba. We understand that the existence of these listings, even temporarily, will be concerning to you. We want to reassure you that all the data are de-identified; they do not contain any personally identifying information (such as names, addresses, dates of birth, and NHS numbers).

By making data available responsibly to scientists around the world, UK Biobank is allowing discoveries to be made that would not otherwise be possible, leading to new ways to prevent and treat disease, and better health for all of us.  Your participation in UK Biobank is making this possible.

We are sorry that this incident has occurred and hope you are reassured by the swift and decisive action we have taken. If you have any questions or concerns, we would be pleased to discuss these with you.

Professor Sir Rory Collins
CEO and Principal Investigator of UK Biobank