UH Cancer Center Epidemiology Division cyberattack exposed historical files, SSNs, health data

The University of Hawaiʻi Cancer Center’s Epidemiology Division disclosed that a cyberattack first identified on Aug. 31, 2025 encrypted and may have exfiltrated historical research files containing names, Social Security numbers and driver’s license numbers, the center said in a Feb. 27, 2026 press release. UH investigators expanded the scope of their inquiry through late February and began mailing notification letters to affected individuals while offering 12 months of credit monitoring and identity-theft protection.

Files implicated in the incident include Hawaiʻi Department of Transportation driver’s license records collected in 2000 and City and County of Honolulu voter registration records collected in 1998, years when those records often used SSNs as identifiers, UH system news said. The exposed material also included recruitment lists and research data with health-related information tied to the Multiethnic Cohort Study, which enrolled more than 215,000 men and women ages 45 to 75 between 1993 and 1996 from five main ethnic and racial groups in Hawaiʻi and Los Angeles.

UH messaging reproduced in local reporting presented two figures: the cyberattack “potentially impacted a total 87,493 individuals” and “about 1.15 million additional people whose personal information might have been included in the historical driver’s license and voter registration records with Social Security number identifiers also could be impacted.” UH investigators also determined the breach “may affect as many as 1.2 million individuals,” a summary figure used in public materials.

The university said the incident was limited to the Cancer Center’s research operations. Scworld reported that UH initially believed only files for a specific cancer study were involved, but subsequent forensic work uncovered additional historical personal information files dating to the 1990s. Scworld also reported UH’s statement that the attack “had no impact on clinical operations or patient care.”

UH engaged cybersecurity experts to investigate the encryption and potential exfiltration of files and implemented what its materials call “extensive cybersecurity and governance enhancements,” although the university has not provided a public list of the specific technical changes. Official updates, enrollment information for credit monitoring and the text of notification letters are posted on the University of Hawaiʻi Cancer Center Cyberattack Information and Resource website, the UH Cancer Center website and UHNews.org; UH has warned people to disregard other websites, social media or messages claiming to represent the university that request personal information.

Edelson Lechtzin LLP announced it is investigating data privacy claims related to the incident and invited people to discuss the case with a lawyer, citing UH’s public disclosure. The law firm’s notice, dated March 3, 2026, follows UH’s Feb. 27 press release and the start of mailed notifications.

Key technical questions remain unanswered: UH has not said whether a ransom demand was made or paid, which specific systems were accessed, or exactly what enhancements were implemented. As the university continues investigations and notifies individuals tied to 1998 voter or 2000 driver’s license records, UH directs those seeking enrollment details and official updates to its Cancer Center cyberattack information pages.