University of New Mexico restores hospital systems, urges no contact with hackers

The University of New Mexico was able to restore systems used by its healthcare facilities after a cyberattack forced it to divert ambulances and cancel classes at its medical school on Monday. 

The school’s Health Sciences Center (HSC) — which includes its hospitals, medical school and biomedical research facilities — said Wednesday all facilities are now fully functional. 

HSC said it did not pay a ransom to the hackers after the incident. The attack was claimed by a ransomware gang on Monday evening. 

The center warned employees, students and patients to be wary of any contact from hackers who may reach out about payment. 

“Following a cybersecurity incident, those responsible may attempt to exploit individuals through additional scams, including false offers of payments or compensation. Patients, students, employees and community members should not respond to or otherwise engage with anyone claiming responsibility for this incident,” HSC said. 

“Do not click links, open attachments, download files or provide personal or financial information. These interactions could expose you to identity theft, fraud or other malicious activity.”

In addition to offering basic cyber guidance, HSC said anyone contacted by the hackers should keep the message and reach out to the FBI's Internet Crime Complaint Center.

The HSC statement comes after the hackers purportedly behind the incident, a new ransomware gang known as BYOD, made several posts apologizing for the attack. 

The group on Tuesday claimed it was offering decryption keys for free because they did not know the devices they compromised were used to help patients. They nonetheless threatened to keep the stolen patient and employee data, offering to destroy personal information if people contacted them directly and paid $2,500. 

“We are sorry once again. We have morals and we have a heart, we are not villains,” the group said. 

HSC — which has New Mexico’s only burn unit, children’s hospital and Level 1 trauma center — turned ambulances away to other hospitals for hours on Monday and had to cancel dozens of outpatient surgeries and appointments due to the attack. 

The healthcare facility serves a large percentage of the state’s uninsured population.

The attack took place days after hackers took down the systems of University Hospitals in Cleveland, Ohio, last week, forcing it to operate without critical systems throughout the weekend and into Monday. 

Multiple attacks on healthcare facilities this year have prompted federal and state governments to take action. Earlier this month, the Senate passed a bill expanding federal cyber requirements for healthcare organizations. 

On Monday, the White House unveiled Project Lifeline 250, a new initiative designed to strengthen cybersecurity protections at rural hospitals. The six-month pilot will pair hospitals with tech giants like Microsoft, Cisco and Zscaler that will offer a range of cyber services for free. 

“Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical back up devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” White House National Cyber Director Sean Cairncross said Monday at an event in South Carolina.