Securityransomwarehealthcarecybersecuritynew-mexicohospitals
UNM Hospital, New Mexico's Only Level 1 Trauma Center, Diverted Ambulances After a Red Skull Took Over Staff Screens
A cyberattack on the University of New Mexico Health Sciences Center on Oct. 26 cancelled clinic appointments statewide and sent students home; a group called BYOD claims 36,000 machines, which nobody has confirmed.
Staff found out from their screens. KOB 4 reported that a red skull with the words “Oh no, you have been compromised” replaced employees’ displays, and that a recorded voice told the university to contact the attackers on the messaging app Session. In the partial recording KOB obtained, the voice claims to have student and employee data, including Social Security numbers. Officials haven’t confirmed any of it.
A biology-chemistry student told KOB her department head came in with one instruction: if you’re on a university computer, turn it off immediately.
The Health Sciences Center opened an emergency operations center. A UNM Health spokesperson told patients not to come in: “Emergencies should be handled by 911 and non-emergencies should be delayed until further notice.” KOB reported that UNM Health “diverted all ambulance traffic to other hospitals,” including at Sandoval Regional Medical Center in Rio Rancho. The Journal reported appointments and outpatient surgeries cancelled across more than 30 clinics statewide.
UNM’s statement, quoted in full by KOB, describes a smaller window. “From 12 to 2 p.m., UNM Health temporarily limited its acceptance of new patients,” it says, thanking health systems in Albuquerque and Santa Fe for taking them. At 2 the system “began resuming operations and bringing systems back online in phases.” Outages still forced it to suspend outpatient surgeries and appointments for the rest of the day.
On Tuesday, both hospitals were open and clinics were back to regular appointments, The Paper reported. Health Sciences classes stayed cancelled. The university’s main and branch campuses were never affected.
The same day, The Paper reported, citing security firm VenariX via Infosecurity Magazine, that a ransomware group called BYOD had listed UNM on its leak site. The group says it “compromised 36,000 machines and stole sensitive data,” including student and employee records, research data and internal email. Its claim doesn’t specifically mention patient records. Neither The Paper nor UNM has verified it.
UNM says it notified state and federal law enforcement and brought in outside help, and that “because this remains an active law enforcement investigation, we are limited in what we can share at this time.” Sen. Martin Heinrich told the Journal he was closely monitoring the situation.
What UNM hasn’t said is what the attackers reached. If the leak-site claim about student and employee data holds up, the next notice from UNM will come by mail, and it will say who needs to watch their credit.