UNM Hospitals Reopen After Ransomware Attack, but Gang’s Data Theft Claim Stands Unanswered
UNM Hospital in Albuquerque and Sandoval Regional Medical Center are fully open after a ransomware attack. The attack forced ambulance diversions Monday and closed clinics across New Mexico. The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque on Monday. It canceled appointments at more than 30 clinics. The hospital network operates the state’s only Level 1 trauma center. The diversion left the state without an emergency department capable of treating the most serious injuries.
Presbyterian Healthcare Services and Lovelace Health System coordinated with the UNM Health System. The two providers took additional patients during the diversion. UNM Health limited the new patients it accepted from 12:30 to 2:30 p.m. Monday. Health systems in Albuquerque and Santa Fe took diverted patients instead. Systems began coming back online in phases at 2:30 p.m. At a medical center in Rio Rancho, security guards told arriving patients to reschedule. The FBI is assisting.
What the Gang Claims
A ransomware group called BYOD listed UNM on its data leak site. Cybersecurity intelligence firm VenariX reported the listing. The group claims it compromised 36,000 machines. It claims it stole student and employee personal information, including Social Security numbers. The group also claims it took student records, research data and internal emails.
The group’s claim does not specifically mention patient records. The claim could not be independently verified. UNM has not named the gang or said what caused the outage. UNM has not confirmed the claim. Multiple UNM Health System employees said they heard messages across their computers Monday morning. The messages claimed to have stolen student and employee data and patient information. A recording posted by a KOB reporter captured part of the message.
What UNM Says
UNM says the attack hit some end-user devices. It says the attack did not penetrate core systems or servers. UNM says its critical systems are back online. All UNM Health hospitals are fully open. Ambulances are back to normal. Clinics are seeing patients as scheduled.
UNM’s Health Sciences Center canceled classes Monday and Tuesday. Classes on UNM’s Central and branch campuses continued as normal. Nonessential Health Sciences Center employees stayed home Tuesday. Clinical and essential staff reported as usual. Students with clinical duties reported as usual. Health Sciences classes resume Wednesday. A UNM spokesperson would not comment further, saying the incident remains an active law enforcement investigation. FBI spokesperson Margot Cravens in Albuquerque said the agency was assisting its partner but declined further comment.
The hospital network conducts about 900,000 outpatient visits each year. It receives about 100,000 emergency room visits each year. Breaching a system to play a message on computers is pretty unusual, said Josephine Wolff, a professor of cybersecurity policy at Tufts University. “How much work we still have to do to get better at defending ourselves,” Wolff said.
Ransomware is malicious software that locks computer systems. Attackers demand payment to restore access. Hospitals in Albuquerque rely on computer systems for patient care.
UNM Health will contact patients to reschedule appointments and procedures missed Monday. Updates from UNM Health are posted at hscnews.unm.edu.
