A cyberattack hit the University of New Mexico Health Sciences Center (UNM HSC) on Monday 26 October, forcing ambulance diversions and suspending outpatient surgeries at the state’s only Level I trauma centre. A group calling itself BYOD says it did it, and claims it compromised 36,000 systems. UNM has confirmed the incident, not the claim.
What is confirmed
According to UNM’s own updates, security teams began containment around 11am on 26 October after identifying a threat, and notified state and federal law enforcement. Ambulance traffic was diverted from 12:30 to 2:30pm, outpatient surgeries and appointments were suspended for the rest of the day, and systems were restored in phases from 2:30pm. By 2:02pm on 27 October, UNM said critical electronic systems were back online, all UNM Health hospitals were open and ambulance traffic was normal. Classes at four health-sciences colleges were cancelled, and UNM said academic and research programmes were expected to resume on Wednesday 28 October. Times are Mountain time.
UNM’s assessment is that “some end-user devices” were affected and core systems and servers were not penetrated. It describes a “cybersecurity event” under criminal investigation and had not, as of its 2:02pm 27 October update and the press requests for comment, publicly said whether ransomware was used, whether data was stolen, or whether the electronic health record was touched.
What is only claimed
BleepingComputer reports that BYOD, a new group with six victims on its leak site (BleepingComputer only), listed UNM and claimed 36,000 systems, Active Directory forests, the Microsoft Entra tenant and two Oracle databases. It also claims Social Security numbers, HR and payroll data, student records, research data, patient information and Cerner EHR rosters. BleepingComputer reported the claim on the leak site and asked UNM for comment; it did not report verifying the contents. A later post reportedly offered free decryption keys to healthcare facilities and up to $2,500 per affected patient, while keeping the stolen data (BleepingComputer only). BankInfoSecurity, citing local broadcaster KOB4, which we did not open, reports an audio message played on staff computers directing administrators to an encrypted messaging service; it attributes this to “the hackers responsible”, not to BYOD by name.
Our assessment: the claims and UNM’s account do not match: “core systems not penetrated” sits awkwardly beside “entire university compromised”. Only the attacker has supplied the 36,000 figure (BleepingComputer says “systems”, Infosecurity Magazine and BankInfoSecurity say “machines”). Treat it as unverified until UNM or an independent party confirms it. We found no evidence as of 28 October in the four sources above of the initial access method, malware or indicators of compromise.
What it means for healthcare (severity “high” is our judgement)
Our assessment: the practical lesson is the speed of the clinical impact. Within hours, a trauma centre diverted ambulances, and core clinical services took about a day to restore even though, by UNM’s account, servers were untouched (BankInfoSecurity describes clinical delivery IT systems as affected). Endpoint-level compromise alone can interrupt care when clinicians depend on workstations. The unresolved question is data: if the stolen-data claim holds, notification duties and extortion pressure on patients become the longer-running problem. BankInfoSecurity notes UNM Health reported a 2021 breach affecting 637,300 people to HHS.
Recommended actions (our advice)
- Rehearse downtime. Test paper-based and diversion procedures for emergency departments and theatres, including how long a workstation-level outage can run before care is affected.
- Segment endpoints from clinical servers, and confirm what a compromised domain admin could reach.
- Watch for patient-targeted fraud. BleepingComputer reports that patients, staff and students are advised to watch for unsolicited communications and phishing; healthcare organisations should brief contact centres on extortion contacting patients directly.
- Monitor for listings of your own organisation on leak sites, and pre-agree who decides on engaging with extortionists.
- Verify before notifying. Check any data-theft claim against your own logs and forensics before acting on it.