Byod Ransomware Compromises 36,000 Systems at UNM Health, Disrupting Patient Care and Surgeries

What happened

The University of New Mexico Health Sciences Center suffered a ransomware intrusion attributed to the Byod gang. The attackers reported compromising 36,000 systems, including Active Directory forests, Group Policy, the Microsoft Entra tenant, and two Oracle databases. They posted a data‑leak notice listing stolen SSNs, payroll and student records, internal emails, research data, hospital appointment information, and Cerner EHR rosters. UNM Health limited new admissions, diverted ambulances, and suspended outpatient surgeries while classes were canceled. The gang later offered free decryption keys for healthcare victims but warned it would retain the stolen data.

Why it matters for trust and compliance

• The incident tests the effectiveness of an organization’s incident‑response control—specifically the ability to detect, contain, and document a ransomware event with evidence that satisfies multiple audit frameworks.
• Map incident‑response procedures to NIST CSF Detect and Respond functions and capture real‑time logs as audit evidence.
• Use continuous evidence collection to demonstrate control effectiveness during breach investigations and regulator reporting.

Who is affected

Recommended actions

1. Activate your ransomware response playbook: isolate affected assets, shut down lateral movement, and engage forensic investigators.
2. Validate that incident‑response controls are mapped to your framework of record and that evidence (logs, snapshots, chain‑of‑custody) is being collected continuously.
3. Notify regulators and affected individuals per HIPAA breach‑notification requirements and retain all communications for audit readiness.