UNM Health ransomware attack disrupts patient care, surgeries
Byod ransomware gang claims attack on UNM Health, disrupting patient care and surgeries.
University of New Mexico Health Sciences Center suffered a ransomware attack attributed to the Byod threat group, forcing temporary suspension of patient admissions, ambulance diversions, and outpatient surgeries. Byod claims to have compromised 36,000 systems across UNM's network, including Active Directory, Microsoft Entra, and Oracle databases, plus access to patient records, SSNs, and HR data. UNM Health reported recovery of critical systems within days, though the threat actor retained stolen data and offered free decryption keys while claiming moral motives.
AI summary of the linked source. Not reviewed by an editor. How this works
Run University of New Mexico Health Sciences Center?
Get an email when a new story names University of New Mexico Health Sciences Center, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Byod threat group compromised 36,000 systems across UNM Health's network, gaining access to Active Directory, Microsoft Entra, and Oracle databases — indicating a severe failure in access control and network segmentation. Once inside, attackers moved laterally at scale, disrupting patient admissions, ambulance diversions, and surgeries, demonstrating how a single breach can cascade into life-threatening operational failures. The exposure of patient records, SSNs, and HR data compounded the harm, creating both regulatory and reputational consequences. Healthcare environments are high-value ransomware targets precisely because downtime carries immediate human cost, making robust preventive controls non-negotiable.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Byod ransomware