After a ransomware attack disrupted University of New Mexico healthcare services, the BYOD ransomware group allegedly offered free decryption keys but said it would retain stolen patient and employee data. The group told affected people to contact it directly and pay $2,500 to have personal information destroyed, while the university warned that follow-on messages could be scams.
The BYOD ransomware group claimed responsibility for a cyberattack on the University of New Mexico Health Sciences Center. The disruption affected hospital operations directly, forcing ambulance diversions and the cancellation of outpatient surgeries and appointments. After the initial attack, the group reportedly offered free decryption keys to restore systems, but said it would retain the stolen patient and employee data rather than deleting it outright.
Rather than stopping at the ransomware demand against the university, the attackers allegedly shifted to targeting individuals. They reportedly told patients and employees that personal information would be destroyed only if those individuals contacted the group directly and paid $2,500. The group reportedly framed this request with language like "We are sorry once again. We have morals and we have a heart, we are not villains," an attempt to build emotional trust before making a payment demand.
This tactic works because it exploits a moment when people are already anxious about their exposed data. A direct message claiming to offer a path to protect personal information feels urgent and personal, especially to patients or employees who may not know how breach notifications normally work. The apologetic tone used in the alleged message is designed to lower suspicion by making the sender seem sympathetic rather than purely predatory.
Organizations and individuals affected by a breach should treat any unsolicited follow-up contact as a potential scam, not a legitimate offer. UNM advised patients, students, employees, and community members not to engage with anyone claiming responsibility for the incident, and instead to preserve the message and report it to the FBI's Internet Crime Complaint Center. Reinforcing this guidance across healthcare and university audiences, including human resources, finance, help desk, and communications teams, helps ensure that follow-on extortion attempts after a breach do not lead to additional identity theft or financial loss.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The BYOD ransomware group claimed responsibility for an attack on the University of New Mexico Health Sciences Center that disrupted hospital operations, including ambulance diversions and cancelled appointments.
The group reportedly offered free decryption keys to the university but told affected patients and employees they would need to pay $2,500 directly to have their personal information destroyed.
UNM advised anyone contacted by the hackers to avoid engaging, keep the message, and report it to the FBI's Internet Crime Complaint Center rather than responding or paying.
Red flags include an unsolicited party claiming responsibility for a breach, demands for direct payment to protect or delete data, and emotional language designed to build trust before a payment ask.
After the UNM hospital cyberattack, a message offers to erase your stolen data. The BYOD ransomware group claims it stole patient and employee records. It offers free decryption keys, but says it will keep the data unless people contact it directly and pay $2,500. Here's the tell: 'We have morals and we have a heart' sits right next to a payment demand. An apology doesn't make data deletion real. UNM says don't engage with anyone claiming responsibility. If you get this message, report it through your official security channel.
Cisco Talos Incident Response reports that phishing drove initial access in over half of Q2 2026 cases, often using QR codes in PDF attachments and trusted cloud hosting to evade email defenses. Attackers frequently bypassed multi-factor authentication using adversary-in-the-middle proxies,…
A criminal actor calling itself “Ransom Busters” is emailing organizations that recently suffered ransomware incidents, claiming it hacked ransomware groups’ servers and can delete the victim’s stolen data for a $20,000–$60,000 fee. The messages ask to speak with the CEO or IT leadership and…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure…
Attackers used social engineering to access an ASOS employee account connected to Snowflake, then used ASOS’s own app notification system to broadcast an extortion message directly to customers. The incident also involved suspected large-scale customer data theft, which increases the risk of highly…
This weekly bulletin highlights multiple real-world incidents, including phishing and impersonation campaigns. Notably, researchers found attackers using malicious “Custom GPTs” on ChatGPT to redirect victims to a Google Sites page and trick them into running commands that install remote-access…
