The personal information of approximately 1.2 million people was compromised in a ransomware attack at the University of Hawaiʻi Cancer Center.
The incident occurred on August 31, 2025, and affected servers supporting the center’s research operations, with no impact on clinical operations or patient care.
According to an incident notice the University of Hawaiʻi published last week, “the extensiveness of the encryption by the threat actors” made it difficult to restore the affected systems and assess the compromised data.
The university says it engaged with the threat actors “to protect the individuals whose sensitive information may have been compromised,” and that it obtained a decryption tool and ensured the destruction of exfiltrated data. The institution did not share details on the paid ransom.
Most of the compromised data, the university says, was associated with a study established in 1993, as part of which more than 215,000 people were recruited between 1993 and 1996.
The records of 87,493 study participants were compromised in the attack. These records include names, Social Security numbers, and, for some participants, research-related and health information was also impacted.
Additionally, the names, driver’s license details, Social Security numbers, and voter registration records of approximately 1.15 million people were compromised, the university says.
“There was no impact to information held by the UH Cancer Center’s Clinical Trials operations, patient care, or any other divisions of the UH Cancer Center. There was no impact on UH student records,” the institution says.
University of Hawaiʻi is providing the impacted individuals with 12 months of free credit monitoring and identity theft services.
The university says its investigation into other potentially compromised information continues, with support from law enforcement and cybersecurity experts.
Related: Madison Square Garden Data Breach Confirmed Months After Hacker Attack
Related: Canadian Tire Data Breach Impacts 38 Million Accounts
Related: 38 Million Allegedly Impacted by ManoMano Data Breach
