In more than 20 years of blogging about breaches, DataBreaches has never seen ransomware threat actors offer monetary compensation to patients affected by their attack. We have seen threat actors regret hitting a hospital or a facility providing direct patient care and then offer them a free decryptor and drop the ransom demands, but this goes far beyond anything we have seen in our experience.
Chris Morris reports:
Hackers generally aren’t a group of people that have a lot of regret for their actions. So when a collective of cybercriminals attacked the University of New Mexico hospital earlier this week, no one was expecting any sort of repentance.
But sometimes, life can surprise even the most jaded of people. The day after the attack, the hacker group, BYOD, which claimed responsibility for the action, offered to decrypt the systems it had locked in the hospital, saying they didn’t realize some of those machines were used to assist patients in real-time. They also offered financial compensation to patients who were impacted by their actions.
“To any patient that was affected, please provide us proof, and we will pay you up to $2,500 each for the inconvenience,” the group wrote. “We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data.”
Even so, “we are still going to keep the data,” hackers said.
Read more from MoneyWise at Yahoo!Finance.
UNM lied and the media repeated it — Statement from BYOD
DataBreaches was so surprised by BYOD’s actions that we reached out to them via email. We are reporting their response in full because while accepting responsibility for what they did do, they reject some claims by UNM that were repeated by media outlets:
We do have morals, it was published on our onion when we first created it. We have also stated we don’t mind going for anything so long as it harms the company and not the customers. By that logic, we guess you could say publishing customer data puts them in second-hand or even in some cases first-hand risk, and further allowing them to be harmed directly but we rather see the company get the blame for failing to satisfy the regulations that come to protecting customer data to begin with. That’s the whole point of our model, if you protect your customer’s data, no one will get affected to begin with, happy days for everyone.
We did not mean to hit the hospital or stop infrastructure (we actually didn’t) the media lied, well UNM, and said we stopped it, which is far from the truth. We were locking documents and data rather than actual running applications and critical systems, UNM had a full panic attack and decided to blast everyone into turning their machines off. They are at fault for any critical services going offline because they couldn’t handle the fact we were locking their data and infact, taking it.
At the time we didn’t know UNM turned their systems offline so we offered anyone who was “deeply affected” compensation money, some may argue that $2500 isn’t much, sure, but when UNM slanders our name for something that isn’t true and we still defend ourselves and help the public, what really is much more we have to do?
Additionally, we targeted the University sector ONLY, we placed a readme file on all computers even stating that in real-time that they should tell their professors and teachers and whatever else we said in relations to studies, no mention of the hospital was in place because we NEVER knew it was being impacted, we only realized we had took hospital data after the attack and even then the encrypter didn’t lock live running applications (the “critical” infra). It’s crazy how UNM managed to brainwash the public, but there’s nothing we can do. People can perceive the situation however they want. Only we & UNM know the truth.
tl;dr:
UNM University = Yes
UNMH = NoUNMH and UNM University being on the same AD forest and running on the exact same network/having links to each other. Blame whoever’s wonderful idea that was.