The University of New Mexico Health Sciences Center says security teams began containing a cyberattack at about 11 a.m. on Monday, 26 October. Between 12:30 and 2:30 p.m. UNM Health sent ambulances to other hospitals, and outpatient surgeries and appointments were suspended for the rest of the day. UNM Health runs the state’s only Level I trauma center. By Tuesday afternoon the university said critical systems were back online, hospitals were fully open and clinics had resumed scheduled appointments, though classes at its four health sciences schools stayed canceled.
UNM has not said what kind of attack it was. It says the event affected some end-user devices but did not penetrate core systems or servers. BleepingComputer found that a new ransomware group calling itself Byod had claimed the attack on its leak site. The group says it compromised 36,000 systems, including Active Directory, the Microsoft Entra tenant and two Oracle databases, and claims to hold Social Security numbers, HR and payroll data, student records, internal email, research data, hospital appointment data and patient information. These are the group’s claims; BleepingComputer says UNM had not responded to its questions about them, and UNM’s statement says the event did not penetrate core systems or servers. Byod also said it would hand out decryption keys to healthcare facilities for free and pay up to $2,500 per affected patient, while keeping the stolen data. BleepingComputer notes the group lists six victims on its leak site.
How to check if you’re affected
Affected devices are not known publicly, and UNM has not said that any patient or student data was taken. If you are a patient, student or employee of UNM Health or the Health Sciences Center:
- Expect rescheduling contact from UNM Health if your appointment or procedure was affected, and use the phone numbers on unmhealth.org rather than numbers in unexpected messages.
- Treat messages that mention the incident, a “compensation payment” or a data-breach settlement with suspicion. The payment offer comes from the attackers, not from UNM.
- Watch for a formal notice from UNM if it later confirms data was taken. Until then, consider a free credit report check and a fraud alert or credit freeze if you are concerned about Social Security number exposure, which is the data the group says it holds.
- In an emergency, call 911, as UNM advised.