UNM Health restores systems after cyberattack diverted ambulances for two hours

UNM Hospital and Sandoval Regional Medical Center stayed open throughout the incident, the health system said. From 12:30 to 2:30 p.m. on Monday 26 October it limited new patient admissions and sent ambulance traffic to health systems in Albuquerque and Santa Fe, and it suspended outpatient surgeries and appointments for the rest of the day.

At 2:30 p.m. it began bringing systems back online in phases. By Tuesday, ambulance traffic had returned to normal and clinics had resumed scheduled appointments and procedures, UNM said. Its assessment found the event affected some end-user devices but did not penetrate core systems or servers.

How the incident unfolded

UNM Health detected the network breach around 11:30 a.m. on Monday, Help Net Security reported, citing the message administrators sent to healthcare workers. About 40 minutes later staff were told to shut down and unplug computer systems and turn off Wi-Fi on mobile devices.

The Health Sciences Center activated an emergency operations center and notified state and federal law enforcement, it said. Classes at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health were canceled on Tuesday, and academic and research units stayed closed. Nonessential employees were asked to remain home.

Ransom group's claims

A group calling itself Byod claimed responsibility and said it had compromised 36,000 systems across UNM's main campus and hospital environments, BleepingComputer reported. UNM has not verified that figure. The leak-site post listed Social Security numbers, HR and payroll records, Banner student records, internal emails, research data, hospital appointment data, patient information and Cerner EHR rosters. Help Net Security noted the claims were still unconfirmed.

In a post on Tuesday, Byod offered free decryption keys for locked machines in the hospital sector, promised up to $2,500 per affected patient and said it would keep the stolen data. "We have morals and we have a heart, we are not villains," the group wrote. UNM said it "did not make concessions with any group behind the threat," Dexerto reported.

Byod is new. It emerged in September and lists six victims on its leak site, with data published for three of them. Ransomware groups often overstate what they took to pressure victims into paying, Medical Daily reported.

KOB 4 obtained a partial recording of an automated voice message that played on hospital workers' computers. The message urged administrators to contact the attackers on Session and claimed the group held student data, personal identifiable information and Social Security numbers. Officials have not confirmed those claims.

Why a two-hour diversion matters statewide

UNM Hospital in Albuquerque houses the state's only Level I trauma center, the top tier for treating the most seriously injured patients, and the only one within about 400 miles, Source NM reported. When it goes on diversion, paramedics must take patients to other emergency departments, which may need to stabilize the sickest and then arrange transfers.

The system handles more than 1 million patient visits a year, BleepingComputer reported. UNM said it would work with patients to reschedule missed appointments.

What remains unanswered

UNM says it is limited in what it can share because the incident remains an active law enforcement investigation. The university has not said whether data was copied, how many people may be affected, or whether it has received a ransom demand.