University of New Mexico Health System

Summary

A cyberattack forced the University of New Mexico Health system to divert ambulances, suspend outpatient surgeries and appointments, and cancel classes across its health sciences schools while nonessential staff remained home. The organization, which operates the state’s only Level I trauma center and burn unit, later restored critical electronic systems and resumed normal hospital and clinic operations after working with external security partners. A ransomware group claimed responsibility, stating it compromised tens of thousands of systems including Active Directory, email, and Oracle databases, and alleging theft of personal and patient data such as Social Security numbers, payroll records, and electronic health records; the group also offered free decryption keys for healthcare facilities while retaining the stolen information.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Monday, the University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. The organization’s IT team contained the issue and notified federal law enforcement. For about two hours on Monday, ambulances were diverted to health systems in Albuquerque and Santa Fe. The health system temporarily limited new patient admissions and suspended outpatient surgeries and appointments for the remainder of the day. UNM Hospital and Sandoval Regional Medical Center remained open during the disruption. Employees received alerts on their phones instructing them to turn off and unplug all desktops and to disconnect mobile devices from the hospital Wi-Fi. Late in the afternoon on Monday, the University of New Mexico Health System began resuming operations and bringing systems back online. Patients who had appointments or procedures canceled on Monday were told they would be rescheduled. All appointments were scheduled to resume as scheduled on Tuesday. Classes at the School of Medicine, College of Nursing, College of Pharmacy, and College of Population Health were canceled on Tuesday, including online and remote classes. UNM Health Sciences academic and research units also remained closed on Tuesday, and nonessential employees were instructed to stay home. The health system serves as a major statewide provider with more than one million patient visits annually and operates the state’s only Level I trauma center, burn unit, and children’s hospital, serving a large percentage of the state’s uninsured population.

The University of New Mexico did not publicly disclose the type of cyberattack it suffered. A ransomware gang known as BYOD took credit for the attack on Monday evening, claiming to have compromised 36,000 machines across the university’s main campus and hospital environments. The group stated it had accessed Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases. BYOD claimed possession of student and employee personal data, including Social Security numbers, HR and payroll records, Banner student records, internal emails, research data, hospital appointment data, patient information, and Cerner EHR rosters. The threat actor said it would remove the breach post after the university initiated communication, likely for ransom negotiation. BleepingComputer requested comment from UNM Health Sciences regarding the data theft allegations but received no response. In a subsequent post, BYOD said it would provide free decryption keys for locked systems at healthcare facilities and promised to pay up to $2,500 for every patient affected by the cyberattack. The group also stated it would keep all the stolen data. UNM Health Sciences announced that all critical electronic systems were back online and all UNM Health hospitals were fully open by Tuesday. Ambulance traffic returned to normal, and all clinics resumed scheduled appointments and procedures. The university said the rapid recovery was possible because IT security teams worked with external partners to secure the network. UNM’s assessment determined that the event affected some end-user devices but did not penetrate core systems or servers. Patients, staff, and students were advised to remain vigilant for unsolicited communications and phishing attacks. This incident marked the second major cyberattack on a large state hospital this year, following the March ransomware attack on the University of Mississippi Medical Center.

Sources

Sources available to members: 6 sources.