UH Cancer Center Data Breach Exposes 1.2 Million Patient Records
University of Hawaii Cancer Center Suffers Data Breach
A recent data breach at the University of Hawaii Cancer Center’s Epidemiology Division has exposed the sensitive information of nearly 1.2 million individuals.
Breach Details
The breach, which occurred in August 2025, was perpetrated by a ransomware gang that accessed research files and stole personal data, including Social Security numbers and driver’s license numbers.
The University of Hawaii has confirmed that the breach affected a single research project and was isolated to systems supporting the Epidemiology Division. However, the attack had a significant impact, causing extensive damage and delaying the university’s restoration efforts and investigation into the breach.
Compromised Documents
The compromised documents include files containing names and Social Security numbers from a State Department of Transportation document and voter registration data, as well as health information on several studies, including the Multiethnic Cohort (MEC) Study.
The MEC Study, which was conducted between 1993 and 1996, involved over 87,000 participants, and their personal information may have been included in the breached data.
Notification and Response
The university has sent notification letters to the MEC Study participants and is also notifying other potentially impacted individuals whose contact details were found in the breached data. In total, approximately 1.15 million individuals may have been affected by the breach.
The University of Hawaii has stated that there was no impact to information held by the UH Cancer Center’s Clinical Trials operations, patient care, or any other divisions of the UH Cancer Center. Additionally, there was no impact to UH student records.
Statement from the University
Previous Incidents
The breach is the latest in a series of ransomware attacks to affect educational institutions in recent years. In July 2023, the Hawaii Community College, part of the University of Hawaii, also paid a ransomware gang to decrypt stolen data.
About Author
English