Hacker Group Apologizes After Targeting UNM Hospital in Cyberattack

University of New Mexico Health Sciences Center IT teams identified a cybersecurity threat and quickly initiated containment measures. The disruption forced the health system to temporarily divert ambulance traffic to other facilities in Albuquerque and Santa Fe while suspending outpatient surgeries and appointments for the remainder of the day. As New Mexico's only Level I trauma center, the hospital worked closely with external partners and law enforcement to secure its network. Officials confirmed that critical electronic systems came back online by the following afternoon, allowing normal hospital operations and clinic schedules to resume. Nonessential personnel were initially asked to stay home, and classes across several medical schools were temporarily paused before resuming regular activities later in the week.

While university systems were being restored, a relatively new hacker collective known as BYOD published claims on a Tor leak site asserting that thousands of machines across the main campus and hospital sector were compromised. The post alleged that sensitive databases, internal communications, and employee and student records were stolen. However, as the situation unfolded, the group posted an unexpected update offering free decryption keys specifically for locked devices within the hospital sector. The actors stated they were unaware the network operated real-time patient-assisting machines and claimed they would have avoided targeting those specific systems.

In an unusual twist, the threat actors also offered up to $2,500 to any patient affected by the disruption, citing a moral obligation while maintaining that their primary goal is to expose lax cybersecurity practices. University officials issued warnings regarding potential scams following the incident, advising that malicious actors often attempt to exploit public concern through false promises of compensation. UNM maintained that it made no concessions with any group behind the breach, and federal and local investigations into the event remain ongoing as security researchers verify the true extent of the network compromise.