The University of New Mexico (UNM Health Sciences Center) was subjected to a cyberattack that caused system outages and a temporary disruption to patient care and academic activities. The health institution temporarily began restricting the admission of new patients, diverting ambulances to neighboring hospitals, and suspending surgeries and outpatient appointments.
In contrast, the university administration confirmed that the University of New Mexico Hospital and the Sandoval Regional Medical Center remained open, with clinics resuming their schedules and medical procedures. However, classes in the four health sciences schools were canceled, and non-essential staff were asked to stay home.
Ransomware group claims and breach details
Although the university did not initially disclose the nature of the cyberattack, security reports indicated that a new group calling itself «Byod» claimed responsibility for the attack. The group claimed on its data leak site that it breached thousands of systems across the campus, including the infrastructure, hospitals, and multiple databases.
The ransomware group claimed to have obtained personal data belonging to students and staff, including social security numbers, human resources records, financial and research data, hospital appointment information, and patient records. In an unconventional move, the group later claimed it would provide free system decryption keys to health facilities, offering to pay financial amounts to affected patients in an attempt to present itself as a vulnerability testing entity.
What changes practically?
The Health Sciences Center administration later announced that all critical electronic systems had fully returned to operation, and university hospitals and ambulance traffic were operating normally following intensive efforts by cybersecurity teams in cooperation with external partners to secure the network.
Initial assessments clarified that the incident affected some end-user devices without deeply penetrating core systems or servers. Nevertheless, the concerned authorities urged patients, students, and staff to remain cautious and on alert against any suspicious communications or potential phishing attacks that might exploit the aftermath of the breach.