Hawaii Cyber Threat Landscape: Which Industries Are Most at Risk?

Hawaii's cyber threat landscape is unlike that of any other U.S. state. The islands serve as the strategic hub for America's military presence across the Indo-Pacific region, hosting the U.S. Indo-Pacific Command, Pacific Fleet, Pacific Air Forces, and dozens of other military and intelligence installations. This military concentration makes Hawaii a tier-one target for Chinese, Russian, and North Korean intelligence services — not just the military installations themselves, but the civilian businesses that support them. Layer in a $18-billion-plus tourism economy, healthcare systems serving an isolated population, and critical undersea communications infrastructure, and Hawaii presents a threat landscape where geopolitical tensions, cybercrime, and infrastructure vulnerability intersect in ways found nowhere else in the country.

This analysis examines the specific threats facing Hawaii's key industries and explains why the state's unique geography amplifies cyber risk. For a record of past incidents, see our Hawaii data breach timeline. For compliance guidance, review our Hawaii data privacy and compliance guide.

Hawaii's Economic Profile & Cyber Risk Exposure

Hawaii's economy is highly concentrated in a few sectors, each with distinct cybersecurity risk profiles. The state's gross domestic product is approximately $90 billion, driven primarily by military spending, tourism, and real estate.

• Military and defense: The Department of Defense is the largest employer in Hawaii, with approximately 50,000 active duty personnel and tens of thousands of civilian employees and contractors. Military spending accounts for a significant portion of the state's GDP

• Tourism: Hawaii welcomed approximately 10 million visitors in 2023, generating over $18 billion in spending. The industry employs roughly one in every six Hawaii residents

• Healthcare: Queen's Health Systems, Hawaii Pacific Health, Kaiser Permanente Hawaii, and Tripler Army Medical Center serve a population of 1.4 million spread across eight inhabited islands

• Real estate and construction: A major economic driver that processes high-value transactions susceptible to business email compromise

• Agriculture: Coffee, macadamia nuts, tropical fruits, and aquaculture represent a smaller but growing sector with emerging technology dependencies

Top Cyber Threats Facing Hawaii Businesses in 2025

Nation-State Espionage and Military-Adjacent Targeting

The most strategically significant threat to Hawaii is nation-state cyber espionage. China's People's Liberation Army (PLA) and Ministry of State Security (MSS) actively target organizations connected to the U.S. Indo-Pacific Command, seeking intelligence on military capabilities, operational plans, and defense technology. The Volt Typhoon campaign, attributed to Chinese state-sponsored actors by CISA and the FBI in 2024, specifically targeted critical infrastructure in areas with significant military presence — a description that fits Hawaii precisely. These campaigns aim to pre-position access to critical systems that could be disrupted during a geopolitical crisis.

Ransomware Amplified by Island Isolation

Ransomware attacks in Hawaii carry uniquely amplified consequences because of the state's geographic isolation. When a mainland hospital faces a ransomware attack, patients can be diverted to neighboring hospitals. In Hawaii, particularly on neighbor islands with limited healthcare infrastructure, there may be no alternative within thousands of miles. This isolation creates extraordinary leverage for ransomware operators, who may calculate that Hawaii healthcare organizations face even greater pressure to pay ransoms than their mainland counterparts.

Tourism Infrastructure Attacks

Hawaii's tourism ecosystem processes enormous volumes of personal and financial data through hotel property management systems, airline reservation platforms, car rental systems, activity booking sites, and thousands of point-of-sale terminals. A coordinated attack on tourism infrastructure could disrupt the state's economic engine and damage its global reputation. Individual tourism small businesses — tour operators, vacation rental managers, restaurants — often lack dedicated IT staff and may rely on consumer-grade security tools, creating a fragmented attack surface across the islands.

Undersea Cable and Communications Threats

Hawaii's internet connectivity depends on undersea fiber optic cables that cross the Pacific Ocean floor. While physical attacks on these cables are a separate concern, the communications infrastructure that routes through Hawaii — connecting the U.S. mainland to Asia and the Pacific — is a target for signals intelligence and traffic interception by nation-state actors. Businesses operating in Hawaii should be aware that their data may traverse infrastructure that is subject to elevated surveillance and interception risks.

Disaster-Themed Social Engineering

Hawaii's vulnerability to natural disasters — hurricanes, tsunamis, volcanic eruptions, and wildfires — creates recurring opportunities for social engineering attacks. The 2023 Maui wildfire phishing campaigns demonstrated how attackers exploit disasters to harvest credentials and financial information from both victims and donors. Given Hawaii's ongoing natural disaster risk, businesses and residents must remain alert to disaster-themed phishing throughout the year, not just during active emergencies.

Industry Spotlight — Hawaii's Military-Defense Ecosystem: The #1 Targeted Sector

Hawaii's military-defense ecosystem is the state's most targeted sector by a significant margin. The U.S. Indo-Pacific Command is responsible for the largest geographic area of any combatant command, covering 36 nations and more than half of the world's population. The intelligence, logistics, and strategic planning that flow through Hawaii's military installations make the state a priority target for the intelligence services of multiple nation-states.

The targeting extends far beyond military networks themselves. Chinese cyber espionage operations have repeatedly demonstrated a strategy of attacking the civilian supply chain that supports military operations — IT service providers, logistics companies, telecommunications firms, and even hotels and restaurants frequented by military personnel. In Hawaii, where the military and civilian economies are deeply intertwined, the boundary between military and civilian cyber targets is effectively nonexistent.

Defense contractors based in Hawaii face CMMC requirements, but the broader ecosystem of businesses that interact with military customers — without necessarily holding defense contracts — may not recognize the extent of their exposure. A Honolulu catering company serving military events, a Kailua real estate firm managing military housing, or a Kapolei IT services company with a few defense clients each represents a potential attack vector that sophisticated adversaries will explore.

Why Hawaii Businesses Are Increasingly Targeted

Geopolitical Tensions in the Indo-Pacific

Rising tensions between the United States and China over Taiwan, the South China Sea, and other Indo-Pacific flashpoints directly increase cyber threat levels in Hawaii. As the operational hub for U.S. military presence in the region, Hawaii's significance to both American defense planners and foreign intelligence services grows with each escalation in geopolitical competition. Cyber espionage and pre-positioning campaigns intensify during periods of heightened tension.

Geographic Isolation Amplifies Impact

Hawaii's isolation makes the consequences of a successful cyberattack more severe than an equivalent attack on the mainland. Limited redundancy in healthcare, financial services, and communications infrastructure means that disrupting a single organization can have cascading effects across island communities. Attackers recognize that this amplified impact creates greater pressure to pay ransoms and greater disruption per dollar invested in an attack.

Tourism Creates a Massive Data Footprint

Ten million annual visitors generate an enormous volume of personal and financial data that flows through systems across the islands. This data — including passport information, credit card numbers, travel itineraries, and location data — is valuable to both cybercriminals and intelligence services. The transient nature of tourism makes it difficult to establish persistent security relationships with data subjects, and the seasonal surge in visitors can overwhelm security monitoring capabilities.

The Cyber Insurance Landscape in Hawaii

Hawaii businesses face unique considerations in the cyber insurance market.

• Defense contractors may face underwriting scrutiny related to nation-state threat exposure and CMMC compliance status

• Healthcare organizations must demonstrate comprehensive HIPAA compliance and ransomware resilience, with insurers paying particular attention to Hawaii's isolation-driven risk amplification

• Tourism businesses need coverage that addresses PCI DSS liabilities, business interruption from cyber events, and reputational damage in a market where visitor confidence is essential

• Geographic factors may influence policy terms — some insurers assess Hawaii's distance from incident response resources and its dependency on undersea communications infrastructure as risk factors

Premiums for Hawaii businesses may be influenced by the state's unique risk profile. Demonstrating strong security controls, maintaining documented incident response plans, and working with managed security providers can help reduce premiums and ensure coverage availability.

How Hawaii Businesses Can Reduce Cyber Risk

Given Hawaii's unique threat landscape, risk reduction requires addressing both standard cybersecurity practices and island-specific challenges.

• Military-adjacent businesses: Implement CMMC-aligned security controls even if not contractually required, segment networks handling any military-related data, and conduct background checks on personnel with access to sensitive systems

• Healthcare organizations: Deploy ransomware-resilient backup strategies with mainland replication, implement network segmentation between clinical and administrative systems, and establish mutual aid agreements with other Hawaii health systems for continuity during incidents

• Tourism businesses: Achieve and maintain PCI DSS compliance, implement point-to-point encryption for payment processing, and train employees on social engineering recognition — including guest impersonation scenarios

• All businesses: Plan for incidents with the assumption that mainland help may be delayed, maintain offline communication capabilities, and establish relationships with incident response providers before an emergency

For Hawaii businesses seeking to build security capabilities that bridge the geographic gap, managed IT security services provide continuous monitoring and response from mainland-based security operations centers. Understanding what managed IT services encompass can help Hawaii organizations evaluate the right level of support for their risk profile.

Frequently Asked Questions

Is Hawaii a top target for cyberattacks compared to other states?

Hawaii's per-capita exposure to nation-state cyber threats is among the highest in the country due to the concentration of U.S. Indo-Pacific Command and Pacific Fleet assets. While states like California and Texas experience more total cyberattacks due to larger populations, Hawaii faces an outsized nation-state threat relative to its size that makes it uniquely targeted.

How do undersea cables affect Hawaii's cybersecurity?

Hawaii's internet connectivity depends entirely on undersea fiber optic cables connecting the islands to the mainland and Asia. While these cables are physically resilient, they represent a concentration point for data transit that is subject to potential surveillance and interception. If multiple cables were damaged or disrupted simultaneously — whether by natural events or deliberate action — it could severely degrade Hawaii's connectivity and the security monitoring that depends on it.

Are Hawaii's neighbor islands more vulnerable than Oahu?

Yes. Neighbor islands — Maui, Big Island, Kauai, Molokai, Lanai — generally have fewer cybersecurity resources, smaller IT teams, and more limited incident response capabilities than Oahu-based organizations. Healthcare facilities, government offices, and businesses on neighbor islands often operate with minimal dedicated IT staff, making them more vulnerable to attacks and less able to respond quickly.

How does the Volt Typhoon campaign relate to Hawaii?

Volt Typhoon, attributed to Chinese state-sponsored actors by CISA and the FBI, targeted critical infrastructure in areas with significant U.S. military presence with the goal of pre-positioning for potential future disruption. Given Hawaii's role as the hub of U.S. Indo-Pacific military operations, the state's critical infrastructure — including telecommunications, water systems, and transportation — fits the campaign's target profile. Hawaii businesses in critical infrastructure sectors should review CISA's Volt Typhoon advisories and implement the recommended mitigations.

What should Hawaii businesses do about disaster-themed phishing?

Hawaii businesses should include disaster-themed phishing scenarios in their regular security awareness training. Employees should be trained to verify disaster relief communications through official channels rather than clicking links in emails or text messages. Organizations should also prepare communication templates for their own customers and partners that can be deployed quickly during emergencies, reducing the window in which attackers can impersonate them.

Can a cyberattack on Hawaii tourism affect the entire state economy?

Yes. Tourism accounts for approximately 21% of Hawaii's gross state product, and a significant cyberattack that damaged visitor confidence — such as a major breach of hotel guest data or disruption of airport/booking systems — could reduce visitor arrivals and spending. The concentration of the state's economy in tourism means that cyber risk to the hospitality industry is effectively economic risk to the entire state.