The University of Hawaiʻi Cancer Center’s Epidemiology Division revealed it experienced a data breach after an unauthorized third party accessed and exfiltrated files related to epidemiology studies and recruitment initiatives. Potentially exposed information includes: 

• Social Security numbers (SSNs)
• Driver’s license numbers
• Voter registration records (for City and County of Honolulu) 

According to a notice regarding the incident, “individuals whose personal information may have been included in the historical driver’s license and voter registration records with SSN identifiers number approximately 1.15 million.”  

“Many breach notification laws include a 'safe harbor' provision that notification isn’t necessary if the attacker couldn’t access the underlying data due to encryption,”  says John Bambenek, President at Bambenek Consulting. “That means the attacker likely had their hands on enough data to engage in identity or credit fraud for six months when the affected individuals could have had credit monitoring or freezes put in place to protect themselves.”  

The files affected include: 

1. Two files containing names and associated SSNs. One contained driver’s license numbers and was collected in 2000, and the other contained voter registration information and was collected in 1998. 
2. Study participant files related to Multiethnic Cohort (MEC) Study in addition to other epidemiological studies. These studies saw recruitment from 1993 to 1996, 1994 to 200, and 1995 to 2007. The information exposed may include SSNs, driver’s license numbers and health information. 
3. Two files from national and state public health registries containing SSNs and names. One was closed to additions in 1999, the other in the mid-2000s. 

Affected individuals who participated in the MEC study were mailed notifications on Feb. 23, 2026. All others who my have had SSNs or driver’s license numbers compromised are being notified via email when possible, and/or via publication.  

Jason Soroko, Senior Fellow at Sectigo, comments, “When adversaries aggressively encrypt not only primary data stores but also indexing systems and potentially localized backups, the forensic process of identifying what was compromised becomes complex. Security teams are forced into a recovery phase, having to rebuild systems from the ground up and piece together fragmented data to conduct accurate discovery before they can confidently notify affected individuals.”  

Guru Gurushankar, Senior Vice President & GM, Healthcare and Life Sciences at ColorTokens adds, “Throughout the past year, we have seen healthcare industry breaches which highlight the necessity of preventing unauthorized lateral movement within one’s network.  This is critical for healthcare organizations to maintain their digital operational resilience in the face of relentless cyberattacks, and it does not appear that there will be any letup from these attacks moving forward.  In other words, organizations have to become breach-ready — this is essential to survival.”