Note: This post was written by Claude Opus 4.6. The following is a synthesis of reporting from the Honolulu Star-Advertiser, Honolulu Civil Beat, The Record, SecurityWeek, and other news organizations.
Two weeks ago, we covered the ransomware attack on the University of Mississippi Medical Center — Mississippi’s only Level I trauma center, forced to close 35 clinics and revert to paper records. That attack disrupted patient care across an entire state. The one we’re covering today didn’t shut down a hospital. No surgeries were canceled, no patients were turned away. But it exposed the Social Security numbers of 1.24 million people, and then the university waited six months to tell them.
On August 31, 2025, the University of Hawaii Cancer Center discovered that attackers had compromised servers in its Epidemiology Division. The attackers encrypted data and provided proof they had exfiltrated a portion of it. The university paid a ransom — the amount has not been disclosed — to obtain a decryption tool and what it described as an “affirmation” that the stolen data had been destroyed.
The public didn’t learn about any of this until February 27, 2026.
What Was Stolen
The breach exposed two distinct pools of data.
The first is research data from the Multiethnic Cohort Study, a landmark cancer study launched in 1993 that enrolled over 215,000 adults in Hawaii and Los Angeles County. Continuously funded by the National Cancer Institute, it is one of the largest and most ethnically diverse cancer studies in the world. The breach affected 87,493 study participants, exposing names, Social Security numbers, and health-related information collected through research questionnaires.
The second pool is far larger. The Cancer Center’s servers also contained historical voter registration records from the City and County of Honolulu (1998) and driver’s license records from the Hawaii Department of Transportation (2000). These files contained Social Security numbers for approximately 1.15 million people — because in the 1990s and early 2000s, Hawaii used Social Security numbers as driver’s license numbers. The state DOT and voter registration offices freely provided these lists to the university for research recruitment purposes. It was standard practice at the time.
Combined, the breach potentially exposed SSNs for 1,241,020 individuals. Hawaii’s population in 2000 was approximately 1.21 million. The breach effectively covered nearly every adult who held a driver’s license or was registered to vote in the state at the turn of the century.
Six Months of Silence
Hawaii state law (HRS 487N-4) requires government agencies to report data breaches to the legislature within 20 days of discovery. The Cancer Center discovered the breach on August 31, 2025. Its legislative report is dated December 2025 — roughly four months late. That report did not include the number of individuals affected, a copy of the breach notice, or the number of individuals notified, because none of that had been determined yet.
Notification letters to the 87,493 MEC Study participants weren’t mailed until February 23, 2026. Emails to the broader group of approximately 900,000 people with locatable email addresses went out in early March. The dedicated call center didn’t open until March 2.
That’s six months between discovery and notification. Six months during which 1.24 million Social Security numbers were potentially in criminal hands, and the people those numbers belonged to had no idea.
The university has not explained the delay. The legislative report made no mention of a law enforcement request to withhold notification, the only exception the statute provides for extending the 20-day window.
The Ransom Payment
The University of Hawaii has now paid ransomware attackers twice in three years. In June 2023, the NoEscape ransomware group hit Hawaii Community College, part of the UH system, in what became the first ransom payment in state history. The 2025 Cancer Center breach is the second.
No ransomware group has publicly claimed the Cancer Center attack. The ransom amount has not been disclosed. UH has declined interview requests on the topic.
The promise of data destruction is worth exactly what the university paid for it — possibly nothing. Once data is exfiltrated, there is no technical mechanism to confirm it has been deleted from every copy, every backup, every system the attackers control. The data may already have been sold, shared, or warehoused for future use.
The Response
UH Cancer Center Director Naoto T. Ueno said the center “deeply regrets this incident occurred” and committed to “transparency, accountability and strengthening protections for the research data entrusted to us.” UH President Wendy Hensel announced a full review of IT systems across all 10 UH campuses.
Affected individuals are being offered 12 months of free credit monitoring, $1 million in identity theft insurance, and access to a dedicated helpline. Multiple law firms have announced investigations into potential class action lawsuits.
Why It Matters
What makes this breach particularly striking is the data provenance. These weren’t records the Cancer Center generated through clinical care. They were 25-year-old government records — driver’s license files, voter rolls — that were handed to a research institution under data-sharing practices that were standard in the 1990s but would be considered reckless today. The records sat on research servers for a quarter century, long past any reasonable retention period, waiting for exactly this kind of attack.
The breach also raises questions beyond identity theft. Research participants trusted the university with sensitive health information for the purpose of advancing cancer science. That trust is the foundation of participant recruitment, and breaches like this one make future recruitment harder — not just for the UH Cancer Center, but for research institutions everywhere.
The university has now paid two ransoms in three years. It waited six months to notify victims. And 1.24 million Social Security numbers — numbers that cannot be changed — are now presumed compromised, protected only by the word of the criminals who stole them.
Sources
- Honolulu Star-Advertiser - Social Security numbers of over 1.2M potentially exposed in UH cyberattack
- Honolulu Civil Beat - UH Cyber Hack Exposed Social Security Numbers of Up to 1.15 Million
- Honolulu Civil Beat - UH Engaged With Hackers Who Hijacked Cancer Study Data
- The Record - University of Hawaii Cancer Center confirms data leak
- SecurityWeek - 1.2 Million Affected by University of Hawaii Cancer Center Data Breach
- Hackread - Ransomware Breach at University of Hawaii Cancer Center
- UH Official Announcement
- UH Cancer Center Incident Resource Page
- UH Legislative Report (HRS 487N-4)
- Hawaii Tribune-Herald - Payment to HCC hackers was first for state
- BleepingComputer - Hawaii Community College pays ransomware gang to prevent data leak