The **University of New Mexico Health Sciences Center (UNM Health)** experienced a significant cybersecurity incident, leading to system outages and temporary disruptions in patient care and academic activities. On Monday, **UNM Health** began limiting new patient admissions, diverting ambulances, and suspending certain surgeries and appointments across its facilities. While **UNM Hospital** and **Sandoval Regional Medical Center** remained open, and clinics have since resumed scheduled appointments, classes at four health sciences schools were canceled, and non-essential employees were instructed to stay home. **UNM Health** is a critical statewide provider, handling over a million patient visits annually, with its flagship **UNM Hospital** housing New Mexico's only Level I trauma center. ### Byod Ransomware Claims Responsibility Although **UNM Health** did not immediately disclose the nature of the attack, a nascent ransomware group known as **Byod** has publicly claimed responsibility. In a post on their data leak site, **Byod** asserted compromise of 36,000 systems across **UNM**'s main campus and hospital environments. This allegedly includes **Active Directory** forests, **Group Policy** infrastructure, the entire **Microsoft Entra** tenant, and two **Oracle** databases. "This is your entire network and infrastructure compromised, the entire university COMPLETELY," the threat actor stated. **Byod** claims to have accessed a wide array of sensitive student and employee personal data, such as: * **Social Security numbers (SSNs)** * HR, payroll, and **Banner** student records * Internal emails * Research data * Hospital appointment data * Patient information * **Cerner EHR** rosters In a move to pressure payment, **Byod** offered to remove the breach post if the university initiated communication for negotiations. **BleepingComputer**'s attempts to reach **UNM Health Sciences** for comment on these allegations have not yet received a response. ### A Ransomware Group with 'Morals'? In a surprising development, **Byod** later announced it would provide free decryption keys for systems at healthcare facilities and even offered to pay up to $2,500 for every patient affected by the cyberattack. "We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data," the cybercriminals declared. However, they also maintained that they would retain all stolen data.  **Byod** is a relatively new ransomware group, listing six victims on its data leak site, with data already leaked for three. On its FAQ page, the group claims to conduct "pentesting" to expose vulnerabilities and hold data controllers accountable for breaches.  The group asserts that no target is off-limits but selects victims after an initial assessment, focusing on organizations that "look at consumers and/or customers as a number or another dollar in their pockets." ### Recovery and Vigilance **UNM Health Sciences** has since reported that all critical electronic systems are back online, and its hospitals are fully operational. Ambulance traffic has normalized, and clinics have resumed scheduled appointments. The university attributed the swift recovery to the efforts of its IT security teams, working in conjunction with external partners to secure the network. Their assessment indicated that the event primarily affected some end-user devices and did not compromise core systems or servers. Patients, staff, and students associated with **UNM Health** are advised to remain vigilant for unsolicited communications and potential phishing attacks.