Ransomware Disrupts New Mexico Trauma Center and Triggers Legal Fallout for Ohio Health System
What Happened — A ransomware campaign attributed to the Byod group hit two university health systems in the United States. In New Mexico, the University of New Mexico Health Sciences Center (UNM) was forced to divert ambulances, suspend outpatient surgeries, and cancel medical‑school classes after attackers encrypted devices across the campus and hospital environment. Byod later claimed to have compromised roughly 36 000 devices and offered a “free decryption key” for some systems. In Ohio, a separate ransomware incident led to class‑action litigation and an $800 000 settlement with federal regulators over alleged HIPAA violations stemming from a 2023 attack that exposed cancer‑patient radiation treatment photos on the dark web. Both incidents illustrate how ransomware can halt critical patient care, expose sensitive health data, and generate costly regulatory and legal consequences. Source: DataBreachToday
Why It Matters for Trust & Control Assurance — The events test an organization’s incident response and recovery controls; robust, auditable processes are the single most effective way to limit service disruption and demonstrate compliance after a ransomware event.
Who Is Affected — Hospital and health‑system operators, university medical centers, and any organization that stores protected health information (PHI).
Recommended Actions —
- Activate and follow a documented incident‑response plan that includes ransomware‑specific playbooks.
- Verify the integrity of backups, isolate affected networks, and begin forensic collection to preserve evidence for regulatory reporting.
- Conduct a rapid HIPAA risk‑assessment of any disclosed PHI and notify affected individuals per breach‑notification rules.
- Map your response activities to the relevant control objectives (e.g., NIST CSF “Respond” function) and collect continuous evidence for audit readiness.
Technical Notes — Attack vector: ransomware delivered via phishing‑laced emails and lateral movement through compromised credentials. No specific CVE disclosed; the threat actor claims control of 36 000 devices. Data types potentially exposed include patient identifiers, clinical records, internal emails, and research data. Source: [DataBreachToday]