Nyu-Meksiko universiteti Sog'liqni saqlash fanlari markazi tizim uzilishlariga sabab bo'lgan va bemorlarni davolash hamda akademik faoliyatni to'xtatgan kiberhujum haqida ma'lum qildi.
Dushanba kuni universitetning sog'liqni saqlash provayderi UNM Health yangi bemorlarni qabul qilishni vaqtincha cheklashni, tez yordam mashinalarini yaqin atrofdagi shifoxonalarga yo'naltirishni va ambulator operatsiyalar hamda uchrashuvlarni to'xtatishni boshladi.
Hodisa haqida yangilangan ma'lumotda UNM aytishicha, UNM Hospital va Sandoval Regional Medical Center ochiq qoladi va barcha klinikalar bugun, 27-oktabr, seshanba kunidan boshlab rejalashtirilgan uchrashuvlar va muolajalarni qayta boshlaydi.
Favqulodda holatlar haqida sog'liqni saqlash tashkiloti odamlarga 911 ga qo'ng'iroq qilishni maslahat berdi.
Biroq, uning to'rtta sog'liqni saqlash fanlari maktabidagi bugungi darslar bekor qilindi va muhim bo'lmagan HSC xodimlariga uyda qolish buyurildi.
UNM Health har yili 1 milliondan ortiq bemor tashrifi bilan mutaxassis yordamining yirik shtat provayderidir.
Albuquerque'dagi uning asosiy UNM Hospital Nyu-Meksikoning yagona I darajali travma markazini o'z ichiga oladi va eng jiddiy jarohatlangan bemorlarni davolaydi.
Byod ransomware hujumni da'vo qilmoqda
UNM qaysi turdagi kiberhujumga uchraganini oshkor qilmadi, lekin BleepingComputer Byod deb nomlangan yangi ransomware guruhi hujumni da'vo qilganini aniqladi.
Ma'lumotlar sizdirish saytida e'lon qilingan postda tahdid aktori UNMning asosiy kampusi va shifoxona muhitlari bo'ylab 36 000 tizimni, jumladan Active Directory o'rmonlari, Group Policy infratuzilmasi, butun Microsoft Entra tenant va ikkita Oracle ma'lumotlar bazasini buzganini aytdi.
"Bu sizning butun tarmog'ingiz va infratuzilmangiz buzilgan, butun universitet TO'LIQ," deb aytdi tahdid aktori.
Ular talaba va xodimlarning shaxsiy ma'lumotlariga, jumladan quyidagilarga kirish huquqiga ega ekanliklarini da'vo qiladilar:
- Ijtimoiy xavfsizlik raqamlari (SSN)
- HR, ish haqi va Banner talaba yozuvlari
- Ichki elektron pochta xabarlari
- Tadqiqot ma'lumotlari
- Shifoxona uchrashuv ma'lumotlari
- Bemor ma'lumotlari
- Cerner EHR ro'yxatlari
To'lovni majburlash maqsadida Byod ransomware universitet muloqotni boshlaganidan so'ng buzilish postini olib tashlashini aytdi, ehtimol to'lovni muzokara qilish uchun.
BleepingComputer UNM Health Sciences bilan ushbu ma'lumot o'g'irlash da'volari haqida izoh so'rab murojaat qildi, lekin javob olmadi.
Bugungi yangi postda Byod ransomware sog'liqni saqlash muassasalaridagi qulflangan tizimlarni shifrlovchi bepul kalitlarni taqdim etishini aytdi.
Sarlavha
Bundan tashqari, tahdid aktori kiberhujumdan ta'sirlangan har bir bemor uchun 2 500 dollargacha to'lashni va'da qildi.
"Bizda axloq va yurak bor, biz yovuz emasmiz, lekin biz hali ham yomon xavfsizlik tufayli har qanday mijoz ma'lumotlarining buzilishiga olib kelgan kompaniyalarni javobgar tutamiz," deb aytdi kiberjinoyatchilar.
Biroq, tahdid aktori o'g'irlangan barcha ma'lumotlarni saqlab qolishini ham aytdi.
Byod hozirda ma'lumotlar sizdirish saytida oltita jabrlanuvchini ro'yxatga olgan yangi ransomware to'dasi. Ularning uchtasi uchun u allaqachon go'yoki o'g'irlangan ma'lumotlarni sizdirgan.
FAQ sahifasida tahdid guruhi zaifliklarni fosh etish va ma'lumot nazoratchilarini buzilishlar uchun javobgar tutish maqsadida "pentesting" qilayotganini da'vo qiladi.
Manba: BleepingComputer
Byod hech bir nishon chetda emasligini aytadi, lekin u dastlabki baholash qiziqish nishonini aniqlaganidan so'ng jabrlanuvchilarni tanlaydi. Guruh "iste'molchilar va/yoki mijozlarga raqam yoki boshqa dollar sifatida qaraydigan yuqori darajadagilarga" e'tibor qaratishini aytadi.
UNM Health Sciences bugun barcha muhim elektron tizimlari qayta onlayn ekanligini va barcha UNM Health shifoxonalari to'liq ochiq ekanligini aytdi. Tez yordam mashinalari harakati endi normal ishlamoqda va barcha klinikalar rejalashtirilgan uchrashuvlar va muolajalarni qayta boshlagan.
Universitet tez tiklanish IT xavfsizlik jamoalarining "tarmoqni himoya qilish uchun tashqi hamkorlar bilan" ishlashi tufayli mumkin bo'lganini aytdi.
"Ularning baholashi hodisa ba'zi oxirgi foydalanuvchi qurilmalariga ta'sir qilganini, lekin asosiy tizimlar yoki serverlarga kirib bormaganini aniqladi," deb ta'kidlaydi UNM Health Sciences Center.
UNM shifoxonalarida davolangan bemorlar, shuningdek u yerda ishlaydigan va o'qiydigan xodimlar va talabalar so'ralmagan aloqa va fishing hujumlari uchun hushyor bo'lishlari maslahat beriladi.
Hujumchilar haqiqiy hisob ma'lumotlariga ega bo'lgach, ularning harakatlarining faqat 37% to'siladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy hisob ma'lumotlaridan foydalanayotganida, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaani o'lchaydi.
Hisobotni oling
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities.
On Monday, UNM Health, the university’s healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments.
In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27.
Regarding emergencies, the healthcare organization advised that people should call 911.
However, today’s classes at its four health sciences schools are canceled, and nonessential HSC employees were instructed to stay home.
UNM Health is a major statewide provider of specialist care with more than 1 million patient visits annually.
Its flagship UNM Hospital in Albuquerque houses New Mexico’s only Level I trauma center, treating the most seriously injured patients.
Byod ransomware claims the attack
UNM did not disclose the type of cyberattack it suffered, but BleepingComputer found that a new ransomware group called Byod had claimed the attack.
In a post on their data leak site, the threat actor said it had compromised 36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases.
"This is your entire network and infrastructure compromised, the entire university COMPLETELY," the threat actor said.
They claim access to student and employee personal data, including:
- Social Security numbers (SSNs)
- HR, payroll, and Banner student records
- Internal emails
- Research data
- Hospital appointment data
- Patient information
- Cerner EHR rosters
In an attempt to force a payment, Byod ransomware said it would take down the breach post after the university initiated communication, likely for negotiating a ransom.
BleepingComputer has reached out to UNM Health Sciences with a request for comment about these data theft allegations, but we have not received a response.
In a new post today, Byod ransomware said it would provide free keys that decrypt locked systems at healthcare facilities.
Caption
Furthermore, the threat actor promised to pay up to $2,500 for every patient affected by the cyberattack.
"We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data," the cybercriminals said.
However, the threat actor also said that it would keep all the stolen data.
Byod is a new ransomware gang that currently lists six victims on its data leak site. For three of them, it has already leaked the allegedly stolen data.
On its FAQ page, the threat group claims it is doing “pentesting” to expose vulnerabilities and hold data controllers accountable for breaches.
Source: BleepingComputer
Byod says no target is off-limits, but it selects victims after an initial assessment identifies a target of interest. The group says it focuses on “those at the top who look at consumers and/or customers as a number or another dollar in their pockets.”
The UNM Health Sciences said today that all its critical electronic systems are back online and all UNM Health hospitals are fully open. Ambulance traffic is now operating normally, and all clinics have resumed scheduled appointments and procedures.
The university said the quick recovery was possible due to IT security teams working "with external partners to secure the network."
"Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers," UNM Health Sciences Center notes.
Patients who received care at UNM hospitals, as well as staff and students who work and study there, are advised to remain vigilant for unsolicited communications and phishing attacks.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report