The Incident: Multiple healthcare organizations, including the University of Hawaiʻi Cancer Center, have reported ransomware-related security incidents that have affected critical systems and data access.
The Scale: Approximately 1.2 million individuals were affected, with exposed data including personally identifiable information such as Social Security numbers and other sensitive records.
The Attackers: Separately, the ShinyHunters data-breach activity included an attack on Aura, in which approximately 900,000 records were exfiltrated via a targeted voice-phishing (vishing) campaign.
The Trend: Recent incidents show continued use of data exfiltration before disruption, where attackers extract sensitive information prior to encrypting or damaging systems to increase extortion pressure.
The ShinyHunters data breach highlights a broader pattern of targeted data theft campaigns affecting enterprise and healthcare-linked systems. Recent incidents show how attackers gain access through identity-based attacks and exfiltrate sensitive data, increasing operational and regulatory impact.
In the healthcare and research sectors, data integrity remains critical to patient care and ongoing scientific work. Security incidents affecting these environments can disrupt access to systems and expose sensitive information at scale.
Recent attack patterns show a continued reliance on data exfiltration combined with system disruption, where attackers extract sensitive information before encrypting or impacting systems to increase leverage during extortion.
Why are research systems, like those at the University of Hawaii, frequent targets in large-scale data breaches? The incident shows that systems supporting research functions, such as epidemiology programs, can store extensive datasets collected over long periods, making them high-value targets compared to narrowly scoped clinical systems.
The Legacy Trap: The breach at the University of Hawaii Cancer Center exposed Social Security numbers and other identifiers from datasets collected in the 1990s and early 2000s. These records, retained for long-term research purposes, remained accessible within institutional systems, increasing both the volume and sensitivity of the exposed data.
The Cost of Disruption: Incidents affecting research environments can significantly delay access to critical datasets and systems. When large volumes of sensitive data are exposed or systems are taken offline, recovery involves restoring access, validating data integrity, and meeting regulatory obligations, which can extend response timelines and operational impact.
Data loss prevention: Securing your sensitive data
Best practices for data loss prevention and securing sensitive data
The Hexnode solution: Proactive containment
Effective response to incidents like the ShinyHunters data breach requires visibility and control at the endpoint level. Security teams need the ability to monitor device activity, enforce policies, and respond quickly to limit operational and data exposure risks.
Pillar 1: Hexnode DEX (Device Experience and Visibility)
Large-scale data exposure and system disruption often involve abnormal device behavior, such as unexpected file access patterns or unauthorized processes. Hexnode DEX can be positioned as a visibility layer that helps IT teams monitor device health, usage patterns, and compliance status, enabling faster identification of deviations and potential risk indicators.
Pillar 2: Hexnode UEM with Extended Detection Context (Hexnode XDR)
In the event of a suspected compromise, rapid containment is critical. Hexnode UEM enables administrators to remotely lock down devices, enforce restrictions, and control access. When combined with broader detection inputs—referred to here as Hexnode XDR in an extended sense—security teams can act on alerts and isolate affected endpoints to limit lateral movement and reduce further data exposure.
Pillar 3: Policy enforcement and Segmented Access Control
Consistent policy enforcement is essential in sensitive environments such as healthcare and research. Hexnode UEM allows organizations to apply access restrictions, manage application usage, and control device configurations. These controls help reduce exposure by limiting unauthorized access paths and maintaining tighter control over critical data environments.
Mitigation: Building a resilient medical fleet
The University of Hawaiʻi Cancer Center incident affected approximately 1.2 million individuals and shows why healthcare and research organizations need stronger control over endpoint access, application execution, and retained sensitive data.
Strict Application Control: Research workstations should not be allowed to run unapproved scripts, utilities, or third-party management tools. Hexnode UEM can help enforce application allowlisting and blocklisting policies, reducing the chance that unmanaged or unauthorized software runs on endpoints handling sensitive research data.
Moving toward a Zero Trust Data Model: Research database access should not rely only on perimeter controls or valid user credentials. Organizations should verify the user, device, compliance status, and access context before allowing sensitive data access. Hexnode UEM can support this model by keeping endpoints managed, compliant, and policy-enforced before they connect to protected systems.
Featured resource
Hexnode for data security
Comprehensive guide to data security, risks, importance, and protecting business data with Hexnode UEM solutions
The ShinyHunters data breach and similar incidents highlight the growing impact of data exfiltration–driven attacks across healthcare and research environments. These events show how unauthorized access and long-retained sensitive data can increase both operational disruption and regulatory risk.
Strengthening endpoint control, enforcing application policies, and maintaining device compliance are critical steps in reducing exposure. Hexnode UEM enables organizations to manage endpoints consistently, apply security controls, and respond quickly to potential threats.
Organizations handling sensitive research data should prioritize visibility, controlled access, and policy-driven security to limit the impact of future incidents. Evaluate your current endpoint security posture and implement measures that reduce risk across your device environment.
Protect your sensitive data before it’s exposed
Start your 14-day free trial of Hexnode UEM or schedule a demo
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
