A cyberattack on the University of New Mexico Health Sciences Center disrupted patient care and academic activities this week, forcing the health system to divert ambulances, suspend outpatient surgeries and cancel classes before critical systems were restored, with a new ransomware group, Byod, claiming responsibility.
UNM Health began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals and suspending outpatient surgeries and appointments on Monday. The university said UNM Hospital and Sandoval Regional Medical Center remained open and advised people to call 911 in emergencies. On Tuesday, October 27, classes at the four health sciences schools were canceled and nonessential employees were told to stay home.
UNM Health is a major statewide provider of specialist care with more than 1 million patient visits a year, and its flagship UNM Hospital in Albuquerque houses New Mexico's only Level I trauma center.
The university did not disclose the type of attack, but cybersecurity news site BleepingComputer found that Byod, a ransomware group that lists six victims on its data leak site, had claimed it. Byod said it compromised 36,000 systems across UNM's main campus and hospital environments, including Active Directory forests, the entire Microsoft Entra tenant and two Oracle databases, and that it had accessed personal data including Social Security numbers, payroll records, research data and patient information.
"This is your entire network and infrastructure compromised, the entire university COMPLETELY," the threat actor said.
In a post on Tuesday, Byod said it would provide free decryption keys for locked systems at healthcare facilities and promised to pay up to $2,500 for every patient affected by the attack. "We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data," the group said, while also saying it would keep all stolen data.
UNM Health Sciences gave a different assessment, saying that "the event affected some end-user devices but did not penetrate core systems or servers." It said all critical electronic systems were back online and all UNM Health hospitals fully open, crediting IT security teams working "with external partners to secure the network."
Patients, staff and students who received care or work and study at UNM hospitals were advised to remain vigilant for unsolicited communications and phishing attacks. BleepingComputer said it had asked UNM Health Sciences about the data theft allegations and had not received a response.
Analysis
Why This Matters
- Patient care was directly disrupted at New Mexico's only Level I trauma center, with ambulances diverted and outpatient surgeries suspended.
- The group claims to hold sensitive personal data, including Social Security numbers, patient information and student records.
- The two conflicting accounts of the breach's scope will determine what data, if any, may surface in the weeks ahead.
Background
Ransomware groups have increasingly targeted hospitals and universities, which hold large volumes of sensitive data and face acute pressure to restore critical systems quickly. Byod is a new group that currently lists six victims on its data leak site and, on its FAQ page, claims it is doing "pentesting" to expose vulnerabilities and hold data controllers accountable for breaches.
Key Perspectives
Byod ransomware: says it compromised 36,000 systems across UNM's campus and hospital environments and accessed sensitive personal data; it says it will provide free decryption keys and pay up to $2,500 per affected patient, but will keep all stolen data.
UNM Health Sciences: says its assessment determined the event affected some end-user devices but did not penetrate core systems or servers, and that all critical electronic systems are back online.
What to Watch
- Whether Byod follows through on its threat to release the allegedly stolen data.
- Whether UNM initiates communication with Byod, which has said it would remove its breach post once the university does so.
- Any further disclosure from UNM about the data theft allegations, on which it has not yet responded to a request for comment.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe UNM Health cyberattack disrupted patient care and academic activities.BleepingComputer: “The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities.”
- SupportedByod, described as a new ransomware group, claimed responsibility for the attack.BleepingComputer: “BleepingComputer found that a new ransomware group called Byod had claimed the attack.”
- SupportedThe attack led UNM Health to divert ambulances and suspend outpatient surgeries and appointments.BleepingComputer: “On Monday, UNM Health, the university’s healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments.”
- SupportedClasses at the four health sciences schools were canceled and nonessential employees were told to stay home on Tuesday, October 27.BleepingComputer: “all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27. [...] today’s classes at its four health sciences schools are canceled, and nonessential HSC employees were instructed to stay home.”
- SupportedCritical systems were restored and UNM Health hospitals were fully open after the disruption.BleepingComputer: “all its critical electronic systems are back online and all UNM Health hospitals are fully open.”
- SupportedByod said it compromised 36,000 systems across UNM’s main campus and hospital environments.BleepingComputer: “the threat actor said it had compromised 36,000 systems across UNM’s main campus and hospital environments”
- SupportedByod said it accessed personal data including Social Security numbers, payroll records, research data and patient information.BleepingComputer: “They claim access to student and employee personal data, including: Social Security numbers (SSNs) HR, payroll, and Banner student records Internal emails Research data Hospital appointment data Patient information”
- SupportedThe threat actor said, “This is your entire network and infrastructure compromised, the entire university COMPLETELY.”BleepingComputer: “"This is your entire network and infrastructure compromised, the entire university COMPLETELY," the threat actor said.”
- SupportedByod said it would provide free decryption keys for locked systems at healthcare facilities and pay up to $2,500 for every patient affected.BleepingComputer: “Byod ransomware said it would provide free keys that decrypt locked systems at healthcare facilities. [...] the threat actor promised to pay up to $2,500 for every patient affected by the cyberattack.”
- SupportedByod said it would keep all stolen data.BleepingComputer: “the threat actor also said that it would keep all the stolen data.”
- SupportedUNM Health Sciences said the event affected some end-user devices but did not penetrate core systems or servers.BleepingComputer: “"Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers," UNM Health Sciences Center notes.”
- SupportedBleepingComputer said it requested comment from UNM Health Sciences about the data-theft allegations and had not received a response.BleepingComputer: “BleepingComputer has reached out to UNM Health Sciences with a request for comment about these data theft allegations, but we have not received a response.”
