University of Hawaii Cancer Center Ransomware Attack Exposed Participants’ Social Security Numbers
Summary
The University of Hawaii says a 2025 ransomware attack exposed research files containing Social Security and other identifiers. The incident potentially affected 87,493 study participants and up to 1.15 million people in historical records.
Key points
- The university identified the incident around August 31, 2025, and discovered the exposure in December; the attack affected research servers, not patient care or medical records.
- Files included names paired with Social Security numbers, historical driver’s license numbers, voter registration data, and some research information.
- The incident potentially affected 87,493 Multiethnic Cohort Study participants; up to 1.15 million additional people may appear in historical records.
- The university says an unauthorized party accessed the files and had the opportunity to exfiltrate some; actual exfiltration remains uncertain.
- The university obtained a decryption tool and says it received assurances that unlawfully obtained data was destroyed; it reports no evidence the information was published, shared, or misused.
- The university disconnected affected systems, began notifying people, offered credit monitoring and identity theft insurance, and reported security upgrades including system rebuilding and stricter access controls.
Article Details
- Victim Organization
- University of Hawaii Cancer Center
- Incident Type
- Ransomware attack involving encryption of research files and potential data exfiltration
- Data Types Exposed
- Names
- Social Security numbers
- Hawaiʻi driver’s license numbers
- Voter registration information
- Participant questionnaires and health-related research data
- Affected Records
- 87,493 Multiethnic Cohort Study participants were potentially impacted; up to approximately 1.15 million additional individuals may have been included in historical driver’s license and voter registration records.
- Operational Impact
- Affected research systems were disconnected, and encrypted systems required restoration using a decryption tool. The University reported no impact to clinical operations, patient care, medical records, student records, or other university divisions.
- Ransom Or Extortion
- The University engaged with the threat actors to obtain a decryption tool. The source does not report a ransom demand or payment; officials said they secured affirmation that the unlawfully obtained data was destroyed.
- Claim Status
- confirmed