University Data Breach Triggers Lawsuits
The University of Hawaii Cancer Center has disclosed a data breach, prompting immediate class action investigations. The incident highlights the growing intersection of data privacy and insurance, as cyber risk and post-breach claims processing become increasingly critical for both P&C and health carriers.
The ransomware attack, first detected on August 31, 2025, compromised the personal data of approximately 1.2 million individuals. The breach specifically targeted the Epidemiology Division's research servers and did not impact clinical trials or patient care systems. Hackers encrypted and potentially exfiltrated decades of research data, including names, Social Security numbers, and driver's license numbers. Much of the compromised information originated from historical records, such as 1998 voter registration files and driver's license data from 2000. The University of Hawaii engaged with the unidentified ransomware group and paid a ransom to obtain a decryption tool. In return, the university received an affirmation that the exfiltrated data had been destroyed, though no specific details about the ransom amount have been released. The national class action law firm Edelson Lechtzin LLP is now investigating data privacy claims against the university. The investigation is seeking legal remedies for individuals whose sensitive personal information may have been compromised in the attack. This incident underscores the significant financial risk of data breaches in the healthcare sector, where the average cost per breach is the highest of any industry. These costs are driven by factors like regulatory fines, legal fees, and the expense of implementing enhanced cybersecurity measures post-breach. For insurers, the aftermath of such breaches often involves a surge in claims related to identity theft and fraud. Stolen medical information can be used to file false claims for medical services or prescription drugs, a costly problem for both insurance carriers and their customers. The breach also highlights the long-term nature of cyber risk, as compromised Social Security and driver's license numbers are permanent identifiers. This creates a prolonged risk of identity theft, tax fraud, and targeted phishing campaigns for the 1.2 million individuals affected.
