A hacker collective responsible for a severe cyberattack against the University of New Mexico Health Sciences Center has issued a public apology for disrupting critical patient care, offering financial compensation to affected individuals while simultaneously confirming they will retain the stolen data.
The threat actor group, operating under the moniker BYOD, claimed responsibility for the sophisticated digital intrusion that targeted New Mexico’s premier healthcare and academic infrastructure, according to reports by Yahoo Finance. The incident brought unprecedented challenges to the state’s medical network, forcing emergency responders, hospital administrators, and academic leaders to scramble to contain the digital threat and ensure public safety.
The Timeline of the Attack and Emergency Response
Security operations teams at the University of New Mexico (UNM) Health Sciences Center first detected anomalous activity and potential threats within their network infrastructure around 11 a.m. on October 26th. Recognizing the severity of the situation, internal cybersecurity personnel immediately initiated containment protocols to isolate affected endpoints and prevent the lateral spread of the intrusion across the broader institutional network.
Despite these swift defensive measures, the disruption quickly impacted clinical operations. Between 12:30 p.m. and 2:30 p.m. that same day, the impact on hospital infrastructure forced UNM Hospital—the state’s only designated Level I trauma center—to divert incoming ambulances to alternative medical facilities across the region. Additionally, hospital administrators were forced to suspend all outpatient surgeries and routine clinical appointments for the remainder of the day to protect patient safety and maintain focus on critical care cases already underway.
The ripple effects of the cyber incident extended beyond the hospital wards into the academic divisions of the institution. Classes across the UNM School of Medicine, the College of Nursing, the College of Pharmacy, and the College of Population Health were officially canceled the following day as university officials and external digital forensics experts continued to assess the scope of the breach and secure institutional endpoints.
University officials later reported that the malicious cyber event successfully compromised a number of end-user devices across the network. However, critical core systems and primary databases containing core administrative architecture managed to withstand the intrusion without being penetrated.
Thanks to the coordinated efforts of internal IT personnel and specialized security responders, the university managed to stabilize the environment rapidly. By October 28th, normal academic classes, ongoing medical research projects, and full clinical operations were fully restored and functioning normally.
Escalating Claims and the Threat Actor’s Unexpected Stance
Following the disruption of clinical services, the situation evolved when the BYOD hacker group published statements on its dedicated data-leak site. The collective asserted that it had successfully compromised approximately 36,000 machines connected to the network. Furthermore, the group claimed to have exfiltrated vast quantities of sensitive personal information, including Social Security numbers belonging to virtually every student and employee associated with the health sciences center.
To date, the University of New Mexico has not officially confirmed the accuracy of these sweeping claims regarding the volume or specific nature of the stolen data.
In a surprising pivot, the threat actor group later posted an online update announcing that it would provide free decryption keys specifically tailored for locked devices operating within the hospital sector. Explaining their rationale in a statement released through their leak channels, the BYOD group stated that they had initially been unaware of the operational nature of the targeted network.
“We did not know that it was running machines related to assisting patients in real-time… we are still going to keep the data, but we will provide the decryption key for the hospital sector only,” the group stated.
Going a step further, the hackers addressed the human impact of the hospital diversion and appointment cancellations. In their online message, members of the collective directly addressed patients who experienced disruptions in their medical care.
“To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data,” the hackers wrote.
Institutional Warnings and Ongoing Criminal Investigations
In response to the hackers’ public statements and offers of financial compensation, the University of New Mexico firmly reiterated its policy against negotiating or engaging with malicious actors. University leadership confirmed that no concessions of any kind were made to the group behind the cyberattack.
Furthermore, UNM officials issued strict warnings to students, staff, patients, and members of the public, advising them not to communicate or interact with any individuals or entities claiming responsibility for the breach. The institution highlighted the high probability of secondary exploitation following a major cybersecurity event.
“Following a cybersecurity incident, those responsible may attempt to exploit individuals through additional scams, including false offers of payments or compensation,” university representatives warned in a public advisory.
The complex digital intrusion and subsequent data extortion claims remain the subject of an active criminal investigation involving specialized law enforcement agencies and cybersecurity authorities working to identify the individuals operating behind the BYOD moniker.
Comments (0)