University of Hawaii Cancer Center Data Breach Affects 1.2 Million

Post Views: 7

Ransomware Attack on University of Hawaiʻi Cancer Center

A recent ransomware attack on the University of Hawaiʻi Cancer Center has compromised the personal information of approximately 1.2 million individuals.

Incident Details

The incident, which occurred on August 31, 2025, affected servers supporting the center’s research operations, but did not impact clinical operations or patient care.

According to the university, the attackers’ extensive encryption of the affected systems made it challenging to restore the systems and assess the compromised data.

In an effort to protect the individuals whose sensitive information may have been compromised, the university engaged with the threat actors and obtained a decryption tool, ensuring the destruction of exfiltrated data. However, the institution did not disclose whether a ransom was paid.

Compromised Data

The majority of the compromised data was associated with a study established in 1993, which recruited over 215,000 participants between 1993 and 1996. The records of 87,493 study participants were compromised, including names, Social Security numbers, and, for some participants, research-related and health information.

In addition, the names, driver’s license details, Social Security numbers, and voter registration records of approximately 1.15 million people were compromised.

Impact and Response

The university emphasized that there was no impact on information held by the UH Cancer Center’s Clinical Trials operations, patient care, or any other divisions of the UH Cancer Center, nor was there any impact on UH student records.

The University of Hawaiʻi is offering 12 months of free credit monitoring and identity theft services to the affected individuals. The institution’s investigation into potentially compromised information is ongoing, with support from law enforcement and cybersecurity experts.

Conclusion

The incident highlights the importance of robust cybersecurity measures, particularly in the healthcare sector, where sensitive information is often at risk. The university’s decision to engage with the threat actors and obtain a decryption tool may have mitigated the damage, but the incident serves as a reminder of the need for proactive cybersecurity strategies to prevent such attacks in the future.