Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulance
The medical center disclosed the incident on Monday October 26 at 2.30pm MDT, informing patients that all appointments, including scheduled surgeries, were cancelled for the rest of the day.
The medical center disclosed the incident on Monday October 26 at 2.30pm MDT, informing patients that all appointments, including scheduled surgeries, were cancelled for the rest of the day.
UNM Health patients should not show up to UNM Health facilities on October 26; emergencies should be handled by 911 and non-emergencies should be delayed until further notice, the update read.
A further update posted at 10.27pm on October 26 confirmed that all UNM Health hospitals had reopened, and clinics would resume regularly scheduled appointments and procedures from Tuesday, October 27.
We will work with patients to reschedule missed appointments and procedures, HSC added; however, the emerging ransomware group BYOD has reportedly claimed to be behind the incident affecting UNM HSC.
At 2:30pm, UNM Health began resuming operations and bringing systems back online in phases, as it was safe to do so.
Read now: UK Healthcare Sector Records Tenfold Increase in Cyber-Attacks All students enrolled at the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health were told to leave campus on Monday.
However, classes at UNM’s Central and branch campuses are not affected.
Cybersecurity intelligence firm VenariX revealed on X that the group listed the University of New Mexico on its data leak site, claiming to have compromised 36,000 machines and exfiltrated sensitive data.
What happened
The medical center disclosed the incident on Monday October 26 at 2.30pm MDT, informing patients that all appointments, including scheduled surgeries, were cancelled for the rest of the day.
UNM Health patients should not show up to UNM Health facilities on October 26; emergencies should be handled by 911 and non-emergencies should be delayed until further notice, the update read.
What changed
A further update posted at 10.27pm on October 26 confirmed that all UNM Health hospitals had reopened, and clinics would resume regularly scheduled appointments and procedures from Tuesday, October 27.
We will work with patients to reschedule missed appointments and procedures, HSC added; however, the emerging ransomware group BYOD has reportedly claimed to be behind the incident affecting UNM HSC.
Who is affected
At 2:30pm, UNM Health began resuming operations and bringing systems back online in phases, as it was safe to do so.
Read now: UK Healthcare Sector Records Tenfold Increase in Cyber-Attacks All students enrolled at the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health were told to leave campus on Monday.
Why it matters
However, classes at UNM’s Central and branch campuses are not affected.
Cybersecurity intelligence firm VenariX revealed on X that the group listed the University of New Mexico on its data leak site, claiming to have compromised 36,000 machines and exfiltrated sensitive data.
Attribution
Infosecurity Magazine: The medical center disclosed the incident on Monday October 26 at 2.30pm MDT, informing patients that all appointments, including scheduled surgeries, were cancelled for the rest of the day.
Infosecurity Magazine: The researchers said they had observed over 400 incidents in which the function was abused, with “highly consistent” IT-support impersonation tactics deployed by the malicious actors.
Infosecurity Magazine: The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
Infosecurity Magazine: In research published October 25, Wiz said it had tracked the campaign, dubbed Gheist, since September 15 and recovered the branches from more than 850 compromised accounts.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.