BYOD hackers apologise after disrupting UNM hospital systems

Hackers identifying themselves as the BYOD group attacked the University of New Mexico (UNM) health-system, including UNM Hospital (UNMH), earlier this week, according to a report cycle cited by DataBreaches. The attackers said they locked systems and later offered to decrypt the machines they had compromised, telling patients affected by the incident that they would pay up to $2,500 each on provision of proof.

They stated they would “pay you up to $2,500 each for the inconvenience” while conceding they would still retain the data. The group claimed its action was aimed at forcing better security from the company, rather than causing ongoing harm to patients, although it is not clear what portion of patient care was affected or for how long. The article notes that BYOD’s statements included an apology and a commitment not to destroy, but to hold the company to account for security failures.

BYOD subsequently published a statement in which it disputed UNM’s portrayal of events and asserted that it did not intend to disrupt live applications or critical infrastructure. The group suggested that UNM panicked and turned off machines, and asserted that the data lock occurred in a non-live environment with live systems not being actively targeted.

BYOD claimed its focus was the university sector and that it had placed a readme on machines to inform staff, while denying that hospital systems were intentionally targeted. The report cites material from DataBreaches, Gizmodo and Yahoo! Finance to document the exchange and the claims from both BYOD and UNM, noting the apparent tension between the university’s description of the incident and the hacker group’s account.