[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUtsoTZUbt5bQqnC42V3k-uZIlZVO1j6RjXSViuqVK-k":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"add6c609-284e-444c-a1ac-a5531ce25022","UNM Health ransomware attack disrupts patient care, surgeries","unm-health-ransomware-attack-disrupts-patient-care-surgeries-7858f0","The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]","University of New Mexico Health Sciences Center suffered a ransomware attack attributed to the Byod threat group, forcing temporary suspension of patient admissions, ambulance diversions, and outpatient surgeries. Byod claims to have compromised 36,000 systems across UNM's network, including Active Directory, Microsoft Entra, and Oracle databases, plus access to patient records, SSNs, and HR data. UNM Health reported recovery of critical systems within days, though the threat actor retained stolen data and offered free decryption keys while claiming moral motives.","Byod ransomware gang claims attack on UNM Health, disrupting patient care and surgeries.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Funm-health-ransomware-attack-disrupts-patient-care-surgeries\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F27\u002FUNM.jpg","2026-10-27T22:07:34+00:00","2026-10-27T23:00:10.118878+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"University of New Mexico Health Sciences Center","vendor",{"name":21,"type":22},"Microsoft Entra","product",{"name":24,"type":22},"Oracle Database",{"name":26,"type":22},"Cerner EHR",{"name":28,"type":29},"Active Directory","technology",{"name":31,"type":32},"Byod","threat_actor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":33,"icon":35,"name":36,"slug":37},null,"Ransomware","ransomware",[39,44],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[50],{"type":51,"value":52,"context":53},"malware","Byod ransomware","Ransomware group claiming responsibility for UNM Health attack; claims 36,000 compromised systems",[18,21,24],{"controls":56,"vendors":144},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":87,"name":88,"problem":89,"products":90},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"slug":116,"name":117,"problem":118,"products":119},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",[145,151],{"slug":146,"name":147,"logo_path":148,"roles":149},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[150],"affected",{"slug":152,"name":153,"logo_path":154,"roles":155},"oracle","Oracle","\u002Fvendor-logos\u002Foracle.png",[150],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":168},"unm-health-ransomware-attack-exposes-critical-infrastructure-and-patient-data","UNM Health Ransomware Attack Exposes Critical Infrastructure and Patient Data","The Byod threat group compromised 36,000 systems across UNM Health's network, gaining access to Active Directory, Microsoft Entra, and Oracle databases — indicating a severe failure in access control and network segmentation. Once inside, attackers moved laterally at scale, disrupting patient admissions, ambulance diversions, and surgeries, demonstrating how a single breach can cascade into life-threatening operational failures. The exposure of patient records, SSNs, and HR data compounded the harm, creating both regulatory and reputational consequences. Healthcare environments are high-value ransomware targets precisely because downtime carries immediate human cost, making robust preventive controls non-negotiable.",[161,162,163,164,165,166,167],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 12: Network Infrastructure Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","MITRE ATT&CK T1078: Valid Accounts",{"GDPR Article 32":169,"MITRE ATT&CK T1078: Valid Accounts":170,"NIST SP 800-53 SI-2: Flaw Remediation":171,"CIS Control 17: Incident Response Management":172,"CIS Control 12: Network Infrastructure Management":173,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":174,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":175},"The exposure of patient records and SSNs requires appropriate technical and organizational measures to protect personal data; GDPR Article 32 obligates healthcare entities to implement controls — including encryption and access restrictions — that could have prevented or limited this data breach.","The attacker's deep access to Active Directory and Entra suggests abuse of valid or compromised credentials for persistence and lateral movement, a technique MITRE ATT&CK T1078 documents and which detection controls such as anomalous login monitoring are specifically designed to surface.","Timely patching of internet-facing systems and identity infrastructure would have reduced the attack surface available to the Byod group; SI-2 requires organizations to identify, report, and remediate vulnerabilities on defined timelines.","The forced suspension of surgeries and ambulance diversions highlights gaps in clinical downtime planning; a mature incident response capability aligned with CIS Control 17 would have pre-defined escalation paths and continuity procedures to reduce patient harm.","Compromise of 36,000 systems across a single network demonstrates a lack of segmentation; CIS Control 12 mandates segmenting networks to contain breaches and prevent attackers from moving freely between clinical, administrative, and identity systems.","A formal vulnerability management process mandated by A.8.8 would have identified weaknesses in Oracle databases and Active Directory configurations before threat actors could exploit them at this scale.","The attacker's ability to compromise Active Directory and Microsoft Entra at scale signals inadequate identity controls; enforcing MFA and least-privilege access under PR.AA would have limited lateral movement and privilege escalation."]