Hawaii Revised Statutes Division 2. Business § 431:3B-306

(a) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a licensee that is an insurer or its third-party service provider, and for which a consumer accessed the insurer's services through an independent insurance producer, the insurer shall notify the producers of record of all affected consumers as soon as practicable as directed by the commissioner.

(b) The insurer is exempt from this obligation in instances where it does not have the current producer of record information for any individual consumer.