Ransomware Group BYOD Disrupts UNM Health Sciences Center, Diverts Ambulances and Exposes Student & Employee Data
What Happened — On 26 October 2024 the University of New Mexico’s Health Sciences Center (HSC) confirmed a “cybersecurity event” that shut down desktop computers and Wi‑Fi access across its hospitals and clinics. The new ransomware gang BYOD claimed responsibility, saying it had compromised “tens of thousands of computers” and exfiltrated personal details—including Social Security numbers—of every student and employee. The attack forced ambulances to be rerouted, outpatient surgeries and appointments to be suspended, and classes to be cancelled. BYOD later posted a ransom note offering free decryption keys for the hospital segment while demanding $2,500 per patient. UNM did not negotiate and restored clinical operations by Wednesday, but the data breach remains unverified.
Why It Matters for Trust & Control Assurance — The incident highlights gaps in incident‑response, backup integrity, and network‑segmentation controls that underpin audit‑ready evidence across multiple frameworks.
Who Is Affected — Higher‑education health providers, university IT departments, and any organization that stores protected health information (PHI) alongside large user populations.
Recommended Actions
- Review and test your ransomware‑response playbook, including communication with clinical staff and external partners.
- Verify that backups are immutable, regularly exercised, and stored offline.
- Enforce multi‑factor authentication (MFA) for all privileged and remote‑access accounts.
- Segment clinical networks from academic and administrative zones to contain future infections.
- Document all remediation steps as evidence for audit readiness.
Technical Notes
- Attack vector: ransomware‑malware payload delivered via unknown initial access method (likely phishing or credential theft).
- Data types exposed: personally identifiable information (PII) such as Social Security numbers, employee and student records.
- No specific CVE disclosed; the threat actor leveraged generic ransomware tooling.