The University of New Mexico’s Health Sciences Center has restored its medical systems after a cyberattack disrupted patient care, diverted ambulances and forced the cancellation of classes and medical appointments.
The center said Wednesday that its hospitals, medical school and biomedical research facilities were fully operational again. The incident began Monday and was publicly claimed that evening by a ransomware group identified as BYOD. UNM said it did not pay ransom to the attackers.
Emergency services were affected
The disruption reached some of the state’s most critical medical operations. The Health Sciences Center includes New Mexico’s only burn unit, its children’s hospital and a Level 1 trauma center, according to the center’s statement.
For several hours Monday, ambulances were redirected to other hospitals. The attack also led to the cancellation of dozens of outpatient surgeries and appointments. Classes at the medical school were canceled as the university worked to contain the incident and bring its systems back online.
| Area | Impact reported by UNM |
|---|---|
| Emergency transport | Ambulances were diverted for several hours |
| Outpatient care | Dozens of surgeries and appointments were canceled |
| Medical education | Classes at the medical school were canceled |
| System recovery | Health Sciences Center facilities were reported operational Wednesday |
The restoration covers the systems used by the Health Sciences Center, but the statement did not provide details about the full scope of the intrusion, whether information was removed from the network or whether all canceled services had been rescheduled. The center’s announcement focused on restoring operations and protecting people from additional harm.
Warning about possible follow-up scams
UNM is urging patients, students, employees and members of the public to be cautious if they receive messages from people claiming to represent the attackers. The Health Sciences Center said cybercriminals sometimes use an initial incident to pursue additional fraud, including requests for money or personal information.
“Patients, students, employees and community members should not respond to or otherwise engage with anyone claiming responsibility for this incident.”
The center said recipients should not click links, open attachments, download files or provide personal or financial information in response to such messages. Those steps are intended to reduce the risk of identity theft, fraud or other malicious activity after the original attack.
- Do not answer messages from people claiming responsibility for the incident.
- Avoid links, attachments and downloads in unsolicited communications.
- Do not provide financial or personal information.
- Preserve suspicious messages and report them to the FBI’s Internet Crime Complaint Center.
Attackers offered conflicting claims
The group that claimed responsibility made a series of posts after the attack. On Tuesday, BYOD said it would provide decryption keys without charge because it had not realized the affected devices were connected to patient care, according to the Health Sciences Center’s account.
At the same time, the group said it would retain stolen patient and employee information. It offered to delete personal data if individuals contacted the hackers directly and paid $2,500. The conflicting statements have not been independently verified in the information provided by UNM, and the center warned people not to engage with the group.
BYOD described itself as remorseful in one of its messages, but its claimed offer placed patients and employees in a vulnerable position by inviting direct contact and payment. UNM’s warning makes clear that any such communication should instead be saved and reported to federal authorities.
Recovery comes after disruption to statewide care
The Health Sciences Center serves a large share of New Mexico’s population, making the interruption broader than a routine technology outage. When ambulances were sent elsewhere, other hospitals had to receive patients who otherwise might have been transported to UNM. The source material does not identify those facilities or state how many patients were redirected.
The incident also showed how a cyberattack can affect more than computer access. It interrupted trauma and specialty-care operations, altered ambulance routing, stopped scheduled outpatient procedures and disrupted the training of medical students. Although UNM reported that its facilities had returned to normal operations Wednesday, the center did not say whether the episode had produced lasting effects on patient schedules or research activity.
For anyone connected to UNM’s hospitals, medical school or research facilities, the immediate guidance is to treat unexpected communications about the attack as potentially fraudulent. The center said messages should be retained for investigators and submitted to the FBI’s Internet Crime Complaint Center rather than answered.
