Independent Journalist specializing in Cybercrime Interviews and News.
Joined March 2012
- Tweets311
- Following776
- Followers56
- Likes23
I reached out directly to BYOD regarding the attack on UNM and received a response.
I've shared in the thread below.
@UNM, I'd welcome your perspective on these claims, particularly regarding the impact on UNM Hospital and the reported disruption to patient care
馃У馃憞
BYOD argues that a README file left on affected devices supports its claim that the attack was intended to target the university, not hospital operations.
The group says the file repeatedly referenced the university and described the data being locked as informational.
BYOD claims most of the data it accessed consisted of small, compressed files associated with old, inactive accounts labeled scim__users_{numerical_identifier}.
The group says it interpreted these as forgotten university devices and user data. That interpretation is BYOD's.
BYOD also argues that a README file left on affected devices supports its claim that the attack was intended to target the university, not hospital operations.
The group says the file repeatedly referenced the university and described the data being locked as informational.
BYOD claims its original target was the University of New Mexico, not UNM Hospital (UNMH).
The group says both entities shared a network and group policy, which allegedly contributed to hospital-related data being caught up in the attack.
馃毃 BREAKING: I reached out directly to BYOD, the threat actor group behind the UNM cyberattack. They responded with several messages disputing aspects of the incident's reporting and explaining why they claim UNM Hospital was affected.
Here鈥檚 what they told me. 馃У
BYOD reportedly offered free decryption for UNM's hospital systems and up to $2,500 per affected patient, while claiming it hadn't realized patient care was involved.
Those statements have now been removed.
I've reached out to BYOD for comment. I'll update if they respond.
Rowan Grey retweeted
Update: BYOD releasing decryption keys for hospital only and offering to pay patients that were affected $2,500...
"UPDATE: UNM
We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That's the whole reason why we came about and we plan to keep it that way."
BYOD ransomware group has posted the University of New Mexico aka UNM
"36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours."
Rowan Grey retweeted
Update of the update:
University of New Mexico aka UNM is completely removed and missing from the BYOD DLS as of this morning 馃憤馃憤馃憤馃憤
Update: BYOD releasing decryption keys for hospital only and offering to pay patients that were affected $2,500...
"UPDATE: UNM
We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That's the whole reason why we came about and we plan to keep it that way."
People worry about AI becoming sentient and destroying humanity.
I'm more concerned about a 15-year-old piece of software running critical infrastructure, maintained by one guy named Dave who retires next month.