UNM Health Cyberattack Disrupted Care; Systems Now Back Online

The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. UNM Health, the university's healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments.

UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics would resume scheduled appointments and procedures starting Tuesday, October 27. It advised that people with emergencies should call 911, that classes at its four health sciences schools are canceled, and that nonessential HSC employees were instructed to stay home.

UNM did not disclose the type of cyberattack it suffered, but BleepingComputer found that a new ransomware group called Byod had claimed the attack. The threat actor said it had compromised 36,000 systems across UNM's main campus and hospital environments, and claimed access to student and employee personal data including Social Security numbers, HR, payroll and Banner student records, internal emails, research data, hospital appointment data, patient information and Cerner EHR rosters. BleepingComputer said it reached out to UNM Health Sciences for comment on the data theft allegations but had not received a response.

The threat actor said it would provide free keys that decrypt locked systems at healthcare facilities and promised to pay up to $2,500 for every patient affected by the cyberattack, but also said it would keep all the stolen data. Byod is a new ransomware gang that currently lists six victims on its data leak site, and for three of them it has already leaked the allegedly stolen data.

UNM Health Sciences said all its critical electronic systems are back online and all UNM Health hospitals are fully open, with ambulance traffic operating normally and all clinics having resumed scheduled appointments and procedures. The university said the quick recovery was possible due to IT security teams working with external partners to secure the network, and an assessment determined that the event affected some end-user devices but did not penetrate core systems or servers. Patients, staff and students were advised to remain vigilant for unsolicited communications and phishing attacks.