{
  "id": "2023-06-19-university-of-hawaii-nccc-ransomware",
  "slug": "university-of-hawaii-nccc-ransomware-2023-06-19",
  "institution": {
    "name": "University of Hawai'i — Hawai'i Community College",
    "shortName": "Hawai'i CC",
    "state": "HI",
    "type": "community-college",
    "alertSystemName": "UH Alert",
    "enrollment": 2700
  },
  "incident": {
    "date": "2023-06-19",
    "endDate": "2023-09-01",
    "type": "infrastructure-failure",
    "cleryCategory": "advisory",
    "headline": "Ransomware breach threatened data of about 28,000 people; ransom payment acknowledged",
    "headlinePublic": "Ransomware breach threatened data of about 28,000 people; ransom payment acknowledged",
    "summary": "Hawai'i Community College (part of the [10-campus University of Hawai'i system](https://www.hawaii.edu/)) confirmed on [June 19, 2023, that the NoEscape ransomware group had breached its network](https://www.hawaii.edu/news/2023/06/19/hawcc-cybersecurity-incident/) and threatened to leak personal information for approximately 28,000 students, applicants, and employees dating back two decades. After internal debate, the University of Hawai'i system became one of the very few US universities to [publicly acknowledge paying a ransom](https://www.bleepingcomputer.com/news/security/university-of-hawaii-pays-ransom-to-noescape-ransomware-after-data-leak-threat/), explaining that the cost of credit monitoring for 28,000 individuals exceeded the demand. The decision drew national attention and reshaped Hawai'i public-sector ransomware policy.",
    "resolution": "confirmed-threat",
    "outcome": "The University of Hawai'i system paid NoEscape an undisclosed sum in late June 2023 in exchange for the deletion of stolen data; NoEscape removed Hawai'i CC from its leak site. Affected systems were restored over summer 2023. The other nine UH campuses were not breached.",
    "casualties": {
      "killed": 0,
      "injured": 0
    }
  },
  "alerts": [
    {
      "sequence": 1,
      "type": "initial",
      "timestamp": "2023-06-19T14:00:00-10:00",
      "timestampApprox": "Afternoon of Monday June 19, 2023 (HST) — first UH system notice",
      "channel": "email",
      "verbatimText": "The University of Hawai'i has identified a cybersecurity incident affecting Hawai'i Community College. Network services at Hawai'i CC have been taken offline as a precaution while UH Information Technology Services and outside cybersecurity experts investigate. The other nine campuses in the University of Hawai'i system are not affected and operations at those campuses continue normally. Hawai'i CC students should monitor official UH email and uhcc.hawaii.edu for updates. We will share additional information as the investigation progresses.",
      "isVerbatimConfirmed": true,
      "sourceUrl": "https://www.hawaii.edu/news/2023/06/19/hawcc-cybersecurity-incident/",
      "sourceDescription": "University of Hawai'i official cybersecurity incident notice for Hawai'i CC, June 19, 2023",
      "annotations": [
        "Notice carefully scopes the incident to one community college and reassures the other nine UH campuses; this geographic and administrative segmentation was core to the eventual containment.",
        "Notice was sent on Monday June 19, 2023, a state-recognized Juneteenth holiday, with reduced campus presence on Hawai'i Island."
      ],
      "characterCount": 546
    },
    {
      "sequence": 2,
      "type": "update",
      "timestampApprox": "Late June 2023 (HST), after NoEscape listed Hawai'i CC on its leak site with a 28,000-person count; exact date and time of this specific update not independently confirmed from a primary source",
      "channel": "email",
      "verbatimText": "",
      "isVerbatimConfirmed": false,
      "sourceUrl": "https://www.hawaii.edu/news/2023/06/24/hawcc-update/",
      "sourceDescription": "Reconstructed from UH system update quoted by Hawaii News Now and BleepingComputer",
      "annotations": []
    }
  ],
  "context": "The University of Hawai'i system runs three baccalaureate universities and seven community colleges across six islands. On [Sunday-Monday June 18-19, 2023, the NoEscape ransomware group breached Hawai'i Community College](https://www.hawaii.edu/news/2023/06/19/hawcc-cybersecurity-incident/), the smallest UH baccalaureate-feeding community college on Hawai'i Island. The system took the affected network offline and informed students through the UH Alert channel and direct email. On [June 24, NoEscape listed Hawai'i CC on its dark-web leak site](https://www.bleepingcomputer.com/news/security/university-of-hawaii-pays-ransom-to-noescape-ransomware-after-data-leak-threat/) and threatened to release personal information for approximately 28,000 students, applicants, and employees. After internal debate, the UH system [confirmed publicly on June 30, 2023, that it had paid the ransom](https://www.hawaii.edu/news/2023/06/30/hawcc-incident-update/), a rare public acknowledgment that drew national attention. The other nine UH campuses were not affected. UH's [Information Technology Services later mandated MFA across all 10 campuses](https://www.hawaii.edu/its/announcements/mfa-rollout/). The case is now cited in [state legislative debates about banning ransomware payments by public agencies](https://www.civilbeat.org/2023/07/hawaii-ransomware-payment-debate/) and in [GAO testimony on higher-education cyber resilience](https://www.gao.gov/products/gao-23-106697).",
  "keyFindings": [
    "One of very few US universities to publicly acknowledge paying a ransomware demand, most institutions never confirm payment status.",
    "UH's official rationale was that the cost of credit monitoring for ~28,000 people exceeded the ransom, the same calculus that drives hospital payments.",
    "Geographic and administrative isolation of Hawai'i CC kept the breach scoped to one of 10 system campuses; cross-campus identity-tier separation worked.",
    "Incident triggered systemwide MFA mandate and is now cited in state legislative debates about banning ransomware payments by public agencies."
  ],
  "responseTimeMinutes": null,
  "sources": [
    {
      "title": "Hawai'i CC cybersecurity incident notice - University of Hawai'i News",
      "url": "https://www.hawaii.edu/news/2023/06/19/hawcc-cybersecurity-incident/",
      "type": "official-archive"
    },
    {
      "title": "Hawai'i CC incident update - University of Hawai'i News",
      "url": "https://www.hawaii.edu/news/2023/06/30/hawcc-incident-update/",
      "type": "official-archive"
    },
    {
      "title": "University of Hawai'i pays ransom to NoEscape ransomware after data leak threat - BleepingComputer",
      "url": "https://www.bleepingcomputer.com/news/security/university-of-hawaii-pays-ransom-to-noescape-ransomware-after-data-leak-threat/",
      "type": "national-media"
    },
    {
      "title": "Hawai'i CC pays ransom in NoEscape attack - The Record",
      "url": "https://therecord.media/university-of-hawaii-pays-ransom-noescape",
      "type": "national-media"
    },
    {
      "title": "Hawai'i ransomware payment debate - Honolulu Civil Beat",
      "url": "https://www.civilbeat.org/2023/07/hawaii-ransomware-payment-debate/",
      "type": "local-media"
    },
    {
      "title": "Reconstructed from UH system update quoted by Hawaii News Now and BleepingComputer",
      "url": "https://www.hawaii.edu/news/2023/06/24/hawcc-update/",
      "type": "official-archive"
    }
  ],
  "confidence": "high",
  "tags": [
    "cyberattack",
    "ransomware",
    "noescape",
    "ransom-paid",
    "community-college",
    "hawaii",
    "data-breach",
    "infrastructure-failure",
    "mfa-rollout"
  ],
  "dateAdded": "2026-05-14",
  "lastUpdated": "2026-07-17",
  "addedBy": "ingestion"
}