Notice of UH Cancer Center cyberattack affecting personal information
Notice of UH Cancer Center cyberattack affecting personal information
https://www.hawaii.edu/news/2026/02/27/notice-of-cyberattack-uh-cancer-center/
Publish Date: 2026-02-27 16:57:00
Source Domain: www.hawaii.edu
Reading time: 4 minutes
The University of Hawaiʻi Cancer Center’s Epidemiology Division was the victim of a cyberattack that possibly exposed records containing Social Security numbers (SSNs) and driver’s license (DL) numbers, mostly from Hawaiʻi DL records collected in 2000 from the State Department of Transportation (when identifiers were usually SSNs) and City and County of Honolulu voter registration records collected in 1998 (also when identifiers were usually SSNs).
The Hawaiʻi DL and Honolulu voter registration records were primarily used to recruit research study participants, principally for the Multiethnic Cohort (MEC) Study. The MEC Study was established in 1993 and recruited more than 215,000 men and women, aged 45 to 75 years, between 1993 and 1996 from five main ethnic/racial groups who were residents of Hawaiʻi and Los Angeles, California. Some of the exposed files also included research data with health-related information on study participants and certain other individuals.
The MEC Study participants potentially impacted a total 87,493 individuals. Additional individuals whose personal information may have been included in the historical driver’s license and voter registration records with SSN identifiers number approximately 1.15 million.
There was no impact to information held by the UH Cancer Center’s Clinical Trials operations, patient care, or any other divisions of the UH Cancer Center. There was no impact to UH student records.
“The UH Cancer Center deeply regrets that this incident occurred and that so many individuals have been impacted,” said Naoto T. Ueno, director of the UH Cancer Center. “We take this matter extremely seriously and are committed to transparency, accountability and strengthening protections for the research data entrusted to us.”
What happened and data involved
During the cyberattack, an unauthorized third party encrypted and potentially exfiltrated data containing personal information. The…
