Byod Ransomware Compromises 36,000 Systems at UNM Health, Disrupting Patient Care and Surgeries
What Happened — The University of New Mexico Health Sciences Center (UNM Health) confirmed a ransomware intrusion that forced the temporary suspension of new patient admissions, outpatient surgeries, and several academic activities. The Byod ransomware gang claimed to have breached 36,000 systems across the campus, including Active Directory forests, Group Policy, the Microsoft Entra tenant, and two Oracle databases. The attackers posted a data‑leak notice listing stolen personal information—SSNs, payroll and student records, internal emails, research data, hospital appointment details, and Cerner EHR rosters. UNM Health has not disclosed whether a ransom was paid; the gang later offered free decryption keys for healthcare victims while threatening to retain the stolen data.
Why It Matters for Trust & Control Assurance — The incident underscores the need for a tested incident‑response control that can produce defensible evidence across identity, cloud, and database layers.
Who Is Affected — Healthcare providers, academic medical centers, and any organization that relies on integrated AD/Entra and EHR platforms.
Recommended Actions
- Activate your ransomware response playbook: isolate compromised endpoints, shut down lateral movement paths, and engage a forensic team.
- Verify that your incident‑response controls (detection, containment, eradication, recovery) are mapped to a framework of record and that evidence (logs, snapshots, chain‑of‑custody records) is being collected in real time.
- Notify regulators and affected individuals per HIPAA breach‑notification rules; document all communications for audit readiness.
Technical Notes — The attackers leveraged ransomware payloads to encrypt files on on‑premises Windows servers and cloud workloads. Compromise of the Microsoft Entra tenant gave them directory‑level privileges, while access to Oracle databases exposed patient and research records. No specific CVE was disclosed, but the attack relied on credential‑theft and lateral movement techniques typical of ransomware families. Source: BleepingComputer