UNM Hospital Systems Restored After Ransomware Attack, No Ransom Paid

What happened

The University of New Mexico’s Health Sciences Center (HSC) experienced a ransomware event on Monday evening that forced the temporary shutdown of critical hospital systems. Ambulance routing was disrupted, elective surgeries were postponed, and medical school classes were canceled until the systems were restored.

The attack was claimed by a new ransomware group known as BYOD. The gang publicly apologized and offered free decryption keys, but also threatened to release stolen patient and employee data unless a ransom of $2,500 was paid. HSC confirmed that no ransom was paid and that all affected systems have been brought back online.

Who is affected

HSC serves as New Mexico’s only burn unit, children’s hospital, and Level 1 trauma center, treating a large portion of the state’s uninsured population. The incident impacted clinical staff, patients, students, and research personnel who rely on the integrated electronic health record (EHR) and laboratory information systems.

Additionally, the university’s medical school, which shares infrastructure with the hospitals, was forced to suspend classes and clinical rotations for several days. The disruption also had a ripple effect on outpatient services, leading to canceled appointments and delayed diagnostics.

Impact

During the outage, ambulances were diverted to other facilities, causing delays in emergency response times. The temporary loss of access to imaging, lab results, and medication orders forced clinicians to rely on paper records and manual workflows, increasing the risk of errors.

Financially, the university faced costs associated with incident response, system restoration, and potential liability for delayed care. The event also exposed sensitive personal health information (PHI) that could be leveraged for identity theft or extortion.

Exposure

BYOD claimed to have accessed patient and employee records stored on compromised servers. While the group offered decryption keys, they also threatened to publish the data if the university did not comply with their demands. No evidence has yet surfaced that the data was released, but the threat remains.

“We are sorry once again. We have morals and we have a heart, we are not villains,” the group said, while simultaneously threatening to destroy personal information if people contacted them directly and paid $2,500.

Defenders should therefore treat any communication from the attackers as a potential social‑engineering attempt. The group’s public posts indicate a willingness to exploit victims through phishing, malicious attachments, and fake payment requests.

What to do

Defenders should take the following actions to mitigate risk and ensure system integrity:

• Verify that all backups are intact and that restoration procedures have been tested; confirm that no ransomware remains on the network.
• Conduct a full forensic audit of the affected servers and endpoints to identify any residual malware or backdoors.
• Review access logs for unusual activity, especially around the time of the incident, and enforce least‑privilege policies on all accounts.
• Implement or reinforce multi‑factor authentication (MFA) across all clinical and administrative systems.
• Educate staff, students, and patients about the dangers of responding to unsolicited messages from attackers; advise them to report any suspicious contact to the university’s security team or the FBI’s Internet Crime Complaint Center.
• Update all software and firmware to the latest versions, prioritizing critical patches for operating systems, EHR platforms, and network devices.
• Deploy endpoint detection and response (EDR) solutions with real‑time monitoring and automated containment capabilities.
• Review and tighten network segmentation between clinical, research, and administrative zones to limit lateral movement.
• Schedule a post‑incident tabletop exercise to test incident response readiness and communication protocols.

What to watch

Security teams should monitor for the following indicators of compromise (IOCs) and emerging threats:

• New phishing campaigns that reference the UNM incident or use similar language to the BYOD group’s public statements.

• Attempts to exploit known vulnerabilities in the EHR or laboratory systems that were not patched before the attack.

• Unusual outbound traffic from internal hosts to external IP addresses, which could signal exfiltration or command‑and‑control activity.

• Social‑engineering attempts targeting patients or staff, such as fake support calls or emails offering “free” decryption keys.

Maintaining a robust threat‑intelligence pipeline and integrating it with SIEM alerts will help detect and respond to these patterns early. Continuous monitoring of the university’s network, coupled with regular vulnerability scans, will reduce the likelihood of a repeat incident.