Tag: cybercrime

Hacker Group Claims UNM Hospital Cyberattack, Then Apologizes and Offers Patients $2,500

Posted on by faz_business



On Monday, University of New Mexico Health Sciences Center information technology teams identified a cybersecurity threat around 11 a.m. and began containment efforts. From 12:30 to 2:30 p.m., the health system temporarily diverted ambulance traffic to other hospitals in Albuquerque and Santa Fe, while outpatient surgeries and appointments were suspended for the remainder of the day as teams worked to protect the network. Notably, UNM Hospital is New Mexico’s only Level I trauma center.

In an update provided by the UNM Health Sciences Center the following afternoon, officials said critical electronic systems were back online. “All UNM Health hospitals are fully open, ambulance traffic has returned to normal operations, and clinics have resumed regularly scheduled appointments and procedures,” the update stated. “Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers. Teams worked with external partners to secure the network and notified state and federal law enforcement.”

Classes at the UNM School of Medicine, College of Nursing, College of Pharmacy, and College of Population Health remained canceled on Tuesday, and nonessential Health Sciences Center employees were asked to remain home. A later update added, “Classes and research activities at the UNM Health Sciences Center resumed Wednesday and clinical operations across all UNM Health facilities are fully functional.”

The incident remains under criminal investigation, which may have limited what the university has shared publicly. UNM has not described the event as a ransomware attack.

BYOD Claims Responsibility and Offers an Apology

While all of this was going on, a hacker group called BYOD also listed the University of New Mexico on its data-leak site, which operates as a Tor hidden service. The post claimed 36,000 machines were compromised across the main campus and the hospital sector, along with two Oracle databases, Oracle HR and Payroll systems, student records, internal emails, electronic health record rosters, and other data. Additionally, it claimed to have every student and employee’s personally identifiable information, including Social Security numbers.

“This is your entire network and infrastructure compromised, the entire university COMPLETELY,” the listing said, according to a republication via Dark Web Informer. “Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.”

On Tuesday, BYOD published an update offering free decryption keys for remaining locked devices in the hospital sector only. The full message read:

“We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That’s the whole reason why we came about and we plan to keep it that way.”

It is unclear whether BYOD provided any decryption assistance that contributed to the restoration of systems at the UNM Health Sciences Center. The UNM Health Sciences Center did not immediately respond to a request for comment on that point from Gizmodo at the time of publication. The university’s public statements have not confirmed the claims from BYOD, so the full extent of those claims remains unverified at this time.

The closest thing to a public statement regarding BYOD was included in a Wednesday update from UNM, which stated, “Following a cybersecurity incident, those responsible may attempt to exploit public concern through additional scams, including false offers of payments or compensation.”

The statement also claimed, “UNM did not make concessions with any group behind the threat.”

What is BYOD?

BYOD is a relatively new ransomware group that emerged roughly a month ago. According to BleepingComputer, the group’s leak site lists six victims so far, including T-Mobile, and it has already published data it claims to have stolen from three of them. The group has described its activity as a form of “pentesting” intended to expose vulnerabilities and hold data controllers accountable.

One of its earlier targets was Trump Mobile, where the group posted a database of what it claimed was 3,615 customer records. Reporters and security researchers later verified parts of the data as authentic. The leaked file contained real names, email addresses, phone numbers, physical addresses, and order details. According to International Cyber Digest, records associated with Trump Organization Chief Information Officer Eric Brunnett and U.S. Congressman Mike Kelly were included in the data. BYOD alleged the breach occurred after malware infected a device at partner company Liberty Mobile, and claimed Trump Mobile responded by saying it had no security team to handle the incident.

Public apologies and offers of free decryption keys from ransomware groups are uncommon, but they’re not completely unprecedented. In January 2023, the LockBit group formally apologized for an attack on Toronto’s Hospital for Sick Children after an affiliate violated internal rules against targeting medical institutions. LockBit stated it had blocked the affiliate and released a free decryptor. The hospital later said it had not paid a ransom and was restoring systems from backups.

Other similar instances of this kind of activity include Conti’s handling of Ireland’s Health Service Executive attack and the release of a master key by TeslaCrypt.



Trump Admin Lets the Cyber Pirates Loose

Posted on by faz_business



The White House will give cybersecurity firms permission to conduct “offensive cyber operations aimed at disrupting criminal organizations,” Bloomberg reported on Thursday.

Trump’s administration has spent months waffling on the idea, which is substantially similar to the centuries-old practice of issuing letters of marque. That’s a type of document from the Age of Sail which extended official protections to private vessels to attack pirates and enemy vessels, a legal (depending on who you ask) and regulated form of piracy known as privateering.

A fact sheet on the National Security Presidential Memorandum (NSPM) states the interagency National Coordination Center will split oversight of the program between two executive directors from the departments of Homeland Security and Justice. The order encourages security firms to voluntarily enter intelligence-sharing agreements with government agencies from the local to federal level, and propose and help carry out “cyber operations that address those threats.”

Currently, most “offensive” cyber operations are undertaken by profit-minded criminals, military units like U.S. Cyber Command, or intelligence agencies and their various proxies. That’s because they’re potentially both illegal and interpretable as acts of aggression, not to mention that they can invite revenge. Private companies, fearing liability issues, have tended to draw the line at what’s called active defense, a somewhat ambiguous term that covers tactics like seeking court orders to take down hacker infrastructure or setting up honeypots.

The NSPM fact sheet states the program’s overseers will develop “rigorous procedures for the review and conduct” of offensive cyber operations. Curiously, cybersecurity firms which want to participate will be required to hold $1 million in bond/escrow, which may be forfeited in the case of a contract violation.

The idea of hacking back isn’t new. In 2019, CyberScoop noted it had attracted the moniker of “worst idea in cybersecurity” among cyber policy types, with experts pointing out that it is hard to accurately identify perpetrators and could result in damaging crossfire between governments and private actors. Even Trump’s own officials have, at times, denied even considering it.

In March 2026, CyberScoop reported then-Office of the National Cyber Director senior adviser Thomas Lind had shot down growing speculation the White House would embrace private offensive operations, stating at a conference the administration is “not interested in fighting pirates with pirates.” National Cyber Director Sean Cairncross told attendees at a security summit in D.C. around the same time that private offensive cyber operations are “not what we’re talking about” when asking for more help from industry.

There’s good reason for hesitation. Obfuscation is an ubiquitous element of cyber attacks, as attackers go to great lengths to prevent detection (at least until the commencement of the attack) and are happy to exploit information asymmetry in any way possible. Threat actors are also often less coherent entities than overlapping, temporary associations between cybercriminals, further complicated by the emergence of a huge cybercrime-as-a-service economy and the formation of supergroups like “Scattered Lapsus$ Hunters”.

Then there’s the possibility of tit-for-tat retaliatory cycles such as those witnessed in the ongoing physical and cyber war between Ukraine and Russia. It’s worth noting that Trump’s White House has a grudge against the Cybersecurity and Infrastructure Security Agency (CISA) for not taking his side while he was trying to overturn the results of the 2020 presidential election. Back in office, his White House has aggressively slashed CISA’s budget and personnel—keep in mind this is the agency that is supposed to help coordinate threat intel sharing and defenses in the event something in cyberspace goes hot.

Booking.com confirms hackers accessed customers’ data

Posted on by faz_business


Booking.com confirmed Monday that hackers may have accessed customers’ personal data, including names, emails, physical addresses, phone numbers, and booking details. The global travel and hotel reservation giant notified customers this past week of the breach, according to several online posts. 

“We’re writing to inform you that unauthorized third parties may have been able to access certain booking information associated with your reservation,” read the notificaiton to customers, according to one user’s post on Reddit. Several other Reddit users replying to the post said they received the same notification. The message from the company included the aforementioned types of compromised data, as well as “anything that you may have shared with the accommodation.” 

The user who posted the notification on Reddit told TechCrunch that they received a phishing message via WhatsApp two weeks ago that included “booking details and personal information.” That suggests hackers are leveraging the stolen information to target Booking.com customers. 

Booking.com spokesperson Courtney Camp told TechCrunch that the company “noticed some suspicious activity involving unauthorized third parties being able to access some of our guests’ booking information. Upon discovering the activity, we took action to contain the issue. We have updated the PIN number for these reservations and informed our guests.” 

The spokesperson declined to answer TechCrunch’s specific questions, including how many customers were affected by this incident and then notified. 

The company told The Guardian that “financial information was not accessed”.

In 2024, TechCrunch reported that hackers had infected several hotels’ computers with consumer-grade spyware, or stalkerware. In one case, a victim was logged into their Booking.com administration portal when the PcTattleTale stalkerware took a screenshot of their screen. 

Techcrunch event

San Francisco, CA
|
October 13-15, 2026

According to the company’s website, 6.8 billion customers have booked hotel rooms and homes since 2010.

US Army soldier pleads guilty to hacking telcos and extortion

Posted on by faz_business


Former U.S. Army soldier Cameron John Wagenius pleaded guilty to hacking telecommunication companies and attempting to extort them by threatening to release stolen files, the Department of Justice announced on Tuesday.

According to the DOJ, Wagenius, who went online with the nickname “kiberphant0m,” conspired to defraud 10 victim companies by stealing their login credentials, using brute force attacks and other techniques, and then used Telegram group chats to transfer the stolen credentials and discusses hacks. 

Wagenius and his conspirators also attempted to extort their victims in private and in public, including on hacking forums such as the notorious BreachForums. They sold some of the stolen data and also used the stolen credentials to commit other frauds, including SIM swapping victims. 

Earlier this year, Wagenius had already pleaded guilty to hacking AT&T and Verizon, a breach that led to him stealing a massive amount of call records.  

Wagenius’ sentencing is scheduled for October 6, and he faces 20 years in prison, according to the press release. 

The hacker has been linked to a series of hacks that originated from the breach of could computing services giant Snowflake.