Hackers Hit Hospital, Then Apologize and Offer Patients Up To $2,500 – While Keeping the Stolen Data

A hacker group that hit a New Mexico university hospital system has apologized for disrupting patient care and offered to pay patients up to $2,500 each, while saying it will keep the data it took.

A group called BYOD has claimed responsibility for the cyberattack on the University of New Mexico Health Sciences Center, reports Yahoo Finance.

Security teams at the health center spotted the threat around 11 a.m. on October 26th and began containment efforts.

From 12:30 to 2:30 p.m. that day, UNM Health diverted ambulances to other hospitals and suspended outpatient surgeries and appointments for the rest of the day.

UNM Hospital is New Mexico’s only Level I trauma center.

Classes at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health were canceled the next day.

The university says the event affected some end-user devices but did not penetrate core systems or servers.

Classes, research and clinical operations were fully back up by October 28th.

On its data-leak site, BYOD claimed it had compromised 36,000 machines and taken personal information, including Social Security numbers, for every student and employee.

UNM has not confirmed those claims.

The group later posted an update offering free decryption keys for locked devices in the hospital sector only.

Says BYOD,

“We did not know that it was running machines related to assisting patients in real-time… we are still going to keep the data, but we will provide the decryption key for the hospital sector only…

To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data.”

UNM says it did not make concessions with any group behind the threat and is warning people not to engage with anyone claiming responsibility.

“Following a cybersecurity incident, those responsible may attempt to exploit individuals through additional scams, including false offers of payments or compensation.”

The incident remains under criminal investigation.