Breach Report: University of Hawaii Maui College breach affects 10,500

(Image source: UHMC, 2021)

One-sentence summary:

The University of Hawaii Maui College suffered a data breach in the middle of February that potentially impacts over 10,500 individuals

Who was involved?

University of Hawaii Maui College, 10,500 individuals, and a threat actor.

What was the timeline?

Mid-February 2023: Breach occurs

April 2023: University of Hawaii posts notice of the breach on their website

What occurred?

The University of Hawaii Maui College suffered a data breach in the middle of February that potentially impacts over 10,500 individuals (University of Hawaii Maui College, 2023). Thankfully, due to network segmentation, the breach was limited to Maui College and did not affect the rest of the University of Hawaii (University of Hawaii Maui College, 2023). No information is specified regarding the breached “personal information.”

Estimated costs:

Associated incident response costs, outside “experts,” breach notification costs, M-F call center, Experian identity services

Involved laws:

Federal: FERPA (potentially)

State: Hawaii: H.R.S. § 487N-1 et seq.

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

UHMC. (2021, February). official-seal.jpg. University of Hawaii Maui College. https://maui.hawaii.edu/wp-content/uploads/2021/02/official-seal.jpg

University of Hawaii Maui College. (2023, April 6). Maui: Data incident reported at UH Maui College | University of Hawaii News. University of Hawaii. Retrieved April 7, 2023, from http://www.hawaii.edu/news/article.php?aId=12520

Commentary:

Good job Maui College on network segmentation. Please restore a valid HTTPS SSL/TLS certificate on your breach notification website/webpage (currently “not secure”).

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com