Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico's Health Sciences Center (HSC) this week.
Responsibility for the attack was claimed by a relatively new ransomware gang, known as BYOD.
On Monday 26 October, the University of New Mexico confirmed that a "cybersecurity event" had impacted the operations of HSC and the UNM Health hospitals and clinics that it operates.
According to media reports, staff were told to turn off their desktop computers and disconnect their mobile devices from the hospital's Wi-Fi.
For a period of time earlier in the week, ambulances were being diverted to other hospitals, and outpatient surgeries and appointments suspended.
BYOD claimed to have compromised tens of thousands of computers, and gained access to the personal details (including social security numbers) of every student and employee.
On its leak website, the ransomware group published the message:
"This is your entire network and infrastructure compromised, the entire university COMPLETELY."
These details have not been confirmed by UNM itself, however.
In an interesting twist, the BYOD gang allegedly offered to hand over the key to decrypt systems in UNM's hospital sector for free, claiming that it had not known at the time of infection that it was locking up computers that were helping patients in need of medical care. The cybercriminal group also said it would offer up to US $2,500 to each affected patients.
Despite this apparent generosity, BYOD seemingly still felt little guilt about infecting the computer systems:
"We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data."
In its latest update on the incident, UNM said that it "did not make concessions with any group behind the threat," and warned patients, students, employees and community members to not respond or engage with anyone claiming responsibility for the attack.
Classes at UNM Health Sciences Center resumed on Wednesday, and all clinical operations across its facilities are said now to be fully functional.
Of course, it's worth remembering that even though it offered decryption keys to UNM, BYOD it said that it would keep the data that it claimed to have stolen. That sensitive data still has a value in the criminal underground, and could continue to be exploited long after the ransomware-hit organization has revived its systems.
One of BYOD's first claimed victims was Trump Mobile, after it leaked the personal data of 3,615 customers through a hacked backend dashboard.
The hackers told International Cyber Digest that they had breached Trump Mobile by first infecting an employee of Liberty Mobile with malware that stole login credentials. According to the cybercriminals, neither firm required multi-factor authentication, which - if it had been in place - would have hardened their security.
The lessons for other organizations should be all too familiar: minimize privileged accounts and enforce phishing-resistant multi-factor authentication wherever possible, segment your network, and monitor for unusual outbound transfers of data.
