UNM keeps getting hacked. Once, it paid the ransom.

UNM’s computers went down Monday. UNM calls it a “cybersecurity issue.” A ransomware gang has claimed the attack. It’s not the first time. Records show UNM had at least 10 data breaches from 2010 to 2021.

Two were ransomware. That’s when hackers lock up computers and ask for money. After one, UNM let its insurer pay them. In two of the 10, at the Foundation and the Law School, no one has said data was taken.

The 10 breaches

• In 2021, hackers hit UNM Health. UNM Health told the U.S. health department it was “a ransomware attack.” It exposed health records for 1,228,093 people. Some had Social Security numbers. UNM says it didn’t pay a ransom that time, KRQE reported.
• In July 2020, someone broke into the UNM Law School’s computers. UNM said then that “it may be a ransomware attack.” The hackers locked up its servers, email, files and backups, KRQE found. KRQE says UNM “secretly authorized” its insurer to pay them. UNM won’t say how much.
• In June 2020, hackers broke into a website a company ran for UNM Police. UNM said data got out.
• In January 2020, hackers took over 16 student accounts, UNM said. They used them to change school billing accounts.
• In 2017, someone got into a UNM Foundation server. It held financial data for “a large portion of its donors,” the Daily Lobo reported. The foundation raises money for UNM. It said it found no sign data was taken.
• In 2016, a breach hit an old College of Education file. It had Social Security numbers for 1,360 students and applicants, UNM said.
• In 2016, a UNM billing error mailed bills to the wrong patients. It hit 2,827 people.
• In 2012, a hacker hit a UNM engineering website. The hacker leaked just over 80 accounts.
• In 2012, someone got into a UNM Cancer Center server for medical studies. It had data on about 2,365 people. Some had Social Security numbers.
• In 2010, a breach on a UNM health computer hit 1,900 people. The U.S. list says no more.

What UNM keeps quiet

KRQE asked UNM for its records on cyberattacks. UNM sent hundreds of pages but blacked out the details. The part KRQE posted has emails in 2021 about a “UNM Law School Cyber Claim.” The rest is blacked out.

KRQE found at least 5 New Mexico public agencies that paid a ransom. UNM is one.

Why it’s “at least” 10

The U.S. list only has health records. It only has breaches that hit 500 or more people. No U.S. list covers student or staff data. So there may be more.

This week

UNM hasn’t said if anything was taken Monday. A ransomware gang called BYOD claims it hacked UNM. UNM hasn’t confirmed that.