BYOD offers UNM hospital patients up to $2,500 after attack

Hackers calling themselves BYOD claimed responsibility for the University of New Mexico (UNM) hospital cyberattack and subsequently offered to decrypt systems and compensate affected patients. In a statement attributed to BYOD, the group said it would pay up to $2,500 to patients who could prove they were inconvenienced, while noting that it would still retain the data.

BYOD framed the action as a response to “bad security” by the company, and asserted it would continue to pursue accountability for data protection, even as it said some hospital systems were not the target of the attack and that critical live apps were not locked. The post emphasised that BYOD’s goal was to hold organisations to account for customer data protection.

UNM and UNM Health (UNMH) have disputed how the incident was portrayed. BYOD provided a lengthy statement via DataBreaches, which includes claims that UNM misrepresented the scope of impact and that the attackers did not disable infrastructure or critical systems as described by some outlets. The group asserted it had targeted the university sector and left a readme file on machines, denying that they had hit hospital systems in real time.

BYOD’s response also asserts that the hospital data was not their initial target and suggests that UNM’s communications contributed to the perception of widespread disruption. The story’s coverage is drawn from DataBreaches, with additional reporting linked to Gizmodo and Yahoo! Finance, and reflects BYOD’s stance alongside UNM’s public responses.