A ransomware attack on the University of Hawaiʻi Cancer Center in 2025 exposed personal data belonging to about 1.2 million people. The incident, which targeted the centre on 31 August 2025, affected servers used to support research operations but not clinical care or patient services. According to General Incident Overview, the unauthorised third party encrypted large amounts of data and indicated that some data had been exfiltrated, though there was no impact on clinical trials, patient care, or student records.
Stolen information included names, Social Security numbers, driver’s licence details and voter registration records, together with some health-related information linked to epidemiological studies. The breach involved three main groups: legacy files from 1998–2000, files tied to the Multiethnic Cohort Study and other cancer research projects, and additional research registry files; about 87,493 participant records were compromised.
The university disconnected affected systems, engaged external cybersecurity experts, notified law enforcement, and is offering 12 months of free credit monitoring and identity protection to those affected, with the incident described as a 2025 ransomware attack by the organisation.