Hackers Stole Research Files, Encrypted Data

Cancer patients who participated in University of Hawaii Cancer Center studies during the 1990s may soon receive a notification that ransomware hackers stole their data in an August 2025 incident. The university’s treatment center – the only National Cancer Institute-designated center in the state – will notify a yet-undisclosed number of individuals about hack.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Experts said the hack spotlights concerning risks involving compromises of medical research data.

The cancer center told state officials in a December disclosure that it paid a ransom for a decryptor key and in exchange of a promise by hackers to destroy the stolen data.

The incident, detected on Aug. 31, did not affect clinical operations or patient care. The affected data was contained in research files “and was not part of the medical records for patients treated at or in conjunction with the Cancer Center,” the cancer center said.

A review into affected systems found that a majority of the affected files related to a specific cancer study and largely contained only research data with no personal Information about the research subjects. That’s not the case for participants who joined the study in the 1990s, when it was common to use Social Security numbers as a pseudo-anonymous identifier.

The center may have narrowly avoided a mass breach incident involving sensitive health data, but the implications of hacked research data are deeply troubling, experts said. Jeff Wichman, a former ransomware negotiator and current director of incident response at security firm Semperis, said the incident may have compromised the data’s integrity.

“Some ransomware groups can overwrite or partially encrypt files in unpredictable ways,” he said. “Even after decryption keys are obtained, files may be corrupted without immediate detection. And worse? Sometimes the keys don’t work at all.”

There are also potential concerns about chain-of-custody disruptions, which are critical in scientific research where traceability is essential, he said.

“If a small portion of data is changed, it can potentially skew results, derail the program and create additional work to ensure accurate outcomes,” he said.

“This can also impact deadlines and program schedules. Cancer research can also generate high-value intellectual property, so organized cybercriminals and state-sponsored groups could view the asset as strategically valuable.”

Semperis research in late 2025 found that among the 77% of healthcare respondents targeted in the past 12 months, 53% paid ransom, and 5% paid more than four times, Wichman said.

Most ransomware experts also counsel against counting on digital extortionists’ promise of deleting data. Hackers almost never comply with that promise – oftentimes selling it or using it for a second round of extortion (see: How Criminals Extort Healthcare Victims With Ransomware).

Since the incident, the center said it has taken several measures to strengthen its data security. That includes installing endpoint protection software, creating “replacement accounts” for compromised user accounts and resetting passwords.

In addition, the center said it has “rebuilt compromised systems to ensure that all malware has been eliminated and created new accounts/passwords to ensure that attackers no longer have access.”