Hacker Group Targets UNM Hospital, Then Offers Unusual Compensation
A ransomware group claims responsibility for a hospital cyberattack before offering public apologies.
1Initial Incident Response
On Monday at 11 a.m., UNM Health Sciences Center identified a cybersecurity threat, triggering immediate containment protocols. Between 12:30 and 2:30 p.m., ambulance traffic was diverted to hospitals in Albuquerque and Santa Fe. Outpatient surgeries and appointments were suspended to protect the network, impacting New Mexico’s only Level I trauma center operations.
2System Restoration Timeline
By Tuesday afternoon, officials confirmed critical electronic systems were back online and hospitals resumed normal operations. While clinical functions returned, classes at the School of Medicine, College of Nursing, and other departments remained canceled until Wednesday. The university stated that the event affected end-user devices but did not penetrate core servers.
3Hacker Group Claims
The hacker group BYOD listed the university on its data-leak site, claiming to have compromised 36,000 machines. They alleged access to Oracle databases, payroll systems, student records, and sensitive personally identifiable information, including Social Security numbers. The group asserted that the entire university network and infrastructure had been completely compromised by their actions.
4Unprecedented Public Apology
BYOD later published an update offering free decryption keys specifically for the hospital sector. They claimed they were unaware the machines supported real-time patient care, stating they intended to target only research data. The group offered up to $2,500 to affected patients, claiming they possess morals and are not typical villains.
5University Official Stance
UNM has not confirmed the hacker group's claims and explicitly stated they did not make any concessions with the threat actors. The university warned that those responsible for cyber incidents often exploit public concern through scams, including false compensation offers. The incident remains under active criminal investigation by state and federal authorities.
6Emergence of BYOD Group
BYOD is a relatively new ransomware entity that emerged approximately one month ago. Their leak site currently lists six victims, including T-Mobile, and they have already published data from three of them. The group frames its activities as a form of pentesting designed to expose vulnerabilities and hold data controllers accountable for security.
7Historical Precedents Observed
Public apologies from ransomware groups are rare but not unprecedented in the cybersecurity landscape. In January 2023, the LockBit group apologized for attacking Toronto’s Hospital for Sick Children after an affiliate violated rules against targeting medical institutions. Similar instances include the release of master keys by TeslaCrypt and Conti’s handling of the Irish health system.
8Broader Security Implications
This incident highlights the ongoing vulnerability of critical infrastructure to ransomware groups claiming ideological motivations. While the university maintains that core systems remained secure, the public nature of the data-leak claims creates significant reputational and operational risks. Organizations must remain vigilant against both the initial breach and subsequent psychological manipulation tactics.
Original article: Gizmodo — Hacker Group Targets UNM Hospital, Then Offers Unusual Compensation