{"id":230075,"date":"2026-02-27T11:57:18","date_gmt":"2026-02-27T21:57:18","guid":{"rendered":"https:\/\/www.hawaii.edu\/news\/?p=230075"},"modified":"2026-03-20T09:40:46","modified_gmt":"2026-03-20T19:40:46","slug":"notice-of-cyberattack-uh-cancer-center","status":"publish","type":"post","link":"https:\/\/www.hawaii.edu\/news\/2026\/02\/27\/notice-of-cyberattack-uh-cancer-center\/","title":{"rendered":"Notice of 糖心Vlog官方<\/abbr> Cancer Center cyberattack affecting personal information"},"content":{"rendered":"Reading time: <\/span> 4<\/span> minutes<\/span><\/span>

\"Glowing<\/p>\n

The University of Hawaiʻi<\/span> Cancer Center\u2019s Epidemiology Division was the victim of a cyberattack that possibly exposed records containing Social Security numbers (SSN<\/abbr>s) and driver\u2019s license (DL<\/abbr>) numbers, mostly from Hawaiʻi<\/span> DL<\/abbr> records collected in 2000 from the State Department of Transportation (when identifiers were usually SSN<\/abbr>s) and City and County of Honolulu voter registration records collected in 1998 (also when identifiers were usually SSN<\/abbr>s).<\/p>\n

The Hawaiʻi<\/span> DL<\/abbr> and Honolulu voter registration records were primarily used to recruit research study participants, principally for the Multiethnic Cohort (MEC<\/abbr>) Study. The MEC<\/abbr> Study was established in 1993 and recruited more than 215,000 men and women, aged 45 to 75 years, between 1993 and 1996 from five main ethnic\/racial groups who were residents of Hawaiʻi<\/span> and Los Angeles, California. Some of the exposed files also included research data with health-related information on study participants and certain other individuals.<\/p>\n

The MEC<\/abbr> Study participants potentially impacted a total 87,493 individuals. Additional individuals whose personal information may have been included in the historical driver\u2019s license and voter registration records with SSN<\/abbr> identifiers number approximately 1.15 million.<\/p>\n

There was no impact to information held by the 糖心Vlog官方<\/abbr> Cancer Center\u2019s Clinical Trials operations, patient care, or any other divisions of the 糖心Vlog官方<\/abbr> Cancer Center. There was no impact to 糖心Vlog官方<\/abbr> student records.<\/strong><\/p>\n

“The 糖心Vlog官方<\/abbr> Cancer Center deeply regrets that this incident occurred and that so many individuals have been impacted,” said Naoto T. Ueno, director of the 糖心Vlog官方<\/abbr> Cancer Center. “We take this matter extremely seriously and are committed to transparency, accountability and strengthening protections for the research data entrusted to us.”<\/p>\n

What happened and data involved<\/h2>\n

During the cyberattack, an unauthorized third party encrypted and potentially exfiltrated data containing personal information. The university notified law enforcement and worked with third-party cybersecurity experts to obtain a decryption tool, and secure an affirmation that any information obtained was destroyed. To date, there is no evidence that any of the information has been published, shared or misused.<\/p>\n

The personal information affected by the incident was located in a subset of research files stored on certain servers that support the 糖心Vlog官方<\/abbr> Cancer Center\u2019s epidemiology research operations, including:<\/p>\n

    \n
  1. Two files containing names and date-of-births in combination with SSN<\/abbr>s: the first, containing DL<\/abbr> numbers, was collected in the year 2000 from the State Department of Transportation; the second, containing voter registration information, was collected in the year 1998 from the City & County of Honolulu. At that time, DL<\/abbr> numbers in Hawaiʻi<\/span> were typically based on SSN<\/abbr>s, and City and County of Honolulu voter registration information also often contained SSN<\/abbr>s.<\/li>\n
  2. Files for study participants in the long-running Multiethnic Cohort (MEC<\/abbr>) Study (recruitment for participants in Hawaiʻi<\/span> and Los Angeles, California from 1993 to 1996) and three other epidemiological studies of diet and cancer focusing on colorectal adenomas (recruitment for participants 1995–2007) and colon cancer (recruitment for participants 1994–2005), which also had SSN<\/abbr>s and\/or DL<\/abbr> numbers in combination with names and date-of-births. They may also have contained questionnaires and other study information on participant health, as well as information pulled from national and state public health registries.<\/li>\n
  3. Two files that contain SSN<\/abbr>s in combination with names collected from national and state public health registries as part of epidemiology research and study recruitment efforts. One file was closed to new names in 1999, and the other in the mid-2000s. The impacted files may also have contained research registry information about individuals\u2019 health.<\/li>\n<\/ol>\n

    Investigations are still ongoing to assess other sensitive information that may have been impacted. 糖心Vlog官方 is confident that any other personal information (SSNs or drivers\u2019 license numbers in combination with names) found will be nominal and, where possible, those individuals will
    \nreceive separate notice.<\/p>\n

    Investigations are still ongoing to assess other sensitive information that may have been impacted.<\/p>\n

    Assistance for potentially affected individuals<\/h2>\n

    Notification letters offering credit monitoring and identity protection services were mailed on February 23 to 87,493 MEC<\/abbr> Study participants, the first group of potentially affected individuals identified. The university is now providing notice to all others potentially impacted via email (approximately 900,000 email addresses were located, but only 757,588 have been validated) and this public announcement and a 糖心Vlog官方<\/abbr> Cancer Center Cyberattack Information and Resource Website<\/a>.<\/p>\n

    (UPDATE: March 20<\/strong> If you believe you may have been impacted and did not receive an email, please check the Spam folder in all of your email accounts. The email should be from Kroll (notice@krollnotifications.com) with the subject line “NOTICE OF DATA INCIDENT.”<\/u>)<\/p>\n

    To assist those who may have been impacted, 糖心Vlog官方<\/abbr> has established dedicated call centers where individuals can:<\/p>\n