University of Hawai'i Cancer Center

What Happened

The University of Hawai'i (UH) Cancer Center disclosed in late February 2026 that it had been the victim of a ransomware attack targeting servers within its Epidemiology Division. According to the university's official statement, the attack was detected on or about August 31, 2025.

The attackers encrypted research data and, according to UH, provided evidence that they had potentially exfiltrated a portion of that data. The university stated that it engaged cybersecurity experts who obtained a decryption tool and secured what it described as "an affirmation that any information obtained was destroyed." UH has not publicly confirmed whether a ransom payment was made, though reporting by Honolulu Civil Beat and the Associated Press noted that the university "engaged with the hackers" and that the FBI generally discourages ransom payments.

The compromised data reportedly includes Social Security numbers and driver's licence numbers drawn largely from Hawaii Department of Transportation records collected around 2000 and City and County of Honolulu voter registration records from 1998. These records were originally used to recruit participants for the Multiethnic Cohort Study, a long-running cancer research project established in 1993. Some research health questionnaires were also among the exposed files.

According to the university's notice and reporting by The Record, approximately 1.15 million to 1.24 million individuals may be affected. Notification letters were sent to initial groups of identified participants starting February 23, 2026, with broader notification via email and public announcement following on February 28.

UH stated that the breach did not affect the Cancer Center's clinical trials operations, patient care, or student records. The university is offering affected individuals 12 months of free credit monitoring and identity theft insurance.

This is not the first ransomware incident involving the University of Hawai'i system. In 2023, Hawai'i Community College dealt with a separate ransomware attack attributed to the NoEscape group, which affected approximately 28,000 individuals.

Regulatory Context

Hawaii state law generally requires government agencies to report breaches to the legislature within 20 days, though exceptions exist when law enforcement advises delay.

The six-month gap between detection and public notification may draw regulatory scrutiny regarding timely disclosure obligations.

Learnings and Recommendations

Research institutions often hold datasets that span decades, collected in eras when SSNs were routinely used as identifiers. These "legacy data vaults" represent a unique risk: the data is highly sensitive, rarely accessed, and frequently overlooked in security planning.

The six-month gap between detection (August 2025) and public notification (February 2026) also raises questions about timely disclosure, a growing area of regulatory focus in the United States. Hawaii state law generally requires government agencies to report breaches to the legislature within 20 days, though exceptions exist when law enforcement advises delay.

For academic and research institutions, this incident is a call to inventory historical research data, assess what identifiers are stored and whether they are still needed, and apply appropriate controls including encryption at rest, network segmentation, and endpoint detection. If data from the 1990s is still sitting on a server accessible from the network, it needs to be either securely archived offline or properly protected.

The broader takeaway is that ransomware groups are increasingly targeting organisations outside the traditional corporate perimeter: universities, research centres, and healthcare systems that may lack the security budgets and staffing of large enterprises but hold data that is just as valuable to attackers.