> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # BYOD claims massive compromise of University of New Mexico infrastructure and data - URL: https://f4n6.co.uk/security-feed/byod-claims-massive-compromise-of-university-of-new-mexico-infrastructure-and-data/ - Published: 2026-10-27T11:40:42.000Z - Updated: 2026-10-27T11:40:42.000Z - Author: Jeff Davies - Tags: #security-feed, BYOD ## 1\. Executive summary Ransomware.live recorded a BYOD claim that 36,000 University of New Mexico systems, two Active Directory forests, the university’s Entra tenant, Oracle databases and healthcare systems were compromised. BYOD also claimed access to student and employee personally identifiable information, Social Security numbers, patient appointments, research data, internal email, payroll records and Cerner EHR rosters, but no independent evidence supports these claims. Attribution to BYOD is unconfirmed, the actor has no MITRE ATT&CK profile, and the reporting is single-sourced; verify before enforcement. No CVE has been assigned, so no CVSS score or severity, EPSS score, or CISA KEV exploitation state applies; direct impact on EMEA financial services is unsubstantiated and depends on whether an institution has identities, integrations or data exchanges connected to the university. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain No intrusion step is confirmed. The Ransomware.live entry contains an actor claim but provides no technical evidence from which to establish initial access, exploitation, execution, persistence, privilege escalation, lateral movement, command-and-control, exfiltration or encryption. 1. Ransomware.live indexed a publicly visible claim attributed to BYOD on 26 October 2026\. This confirms publication of the claim, not compromise of the university. 2. No further attack-chain step can be confirmed from the report. BYOD claims control of 36,000 machines across the University of New Mexico’s main campus and hospital sector. The claimed Active Directory scope includes both forests and Group Policy Objects. Control of Group Policy could permit domain-wide configuration changes or code deployment, but the report does not show that BYOD used those functions. The actor also claims access to the entire Entra tenant, two unspecified Oracle databases, Oracle HR and Payroll, Banner Student Records and internal email. No tenant identifiers, database versions, hostnames, account names, authentication records or access timestamps are supplied. The report does not identify any compromised application, exposed service, vulnerability or credential source. The claimed data includes student and employee PII, Social Security numbers, research information, patient appointments and information, and Cerner EHR rosters. The entry contains no samples, file listings, record counts, screenshots or independent victim confirmation. It does not identify an exfiltration tool, destination, protocol or volume. The actor threatened to take the university down after communication was established. The wording indicates an extortion demand and a threatened availability impact, but it does not establish that files were encrypted, systems were disrupted or ransomware was deployed. No CVE has been assigned. NVD therefore provides no CVSS score or severity, EPSS provides no probability score, and CISA KEV provides no exploitation state for this incident. Attribution to BYOD remains unconfirmed because the actor has no MITRE ATT&CK profile. All technical scope and data-access claims are single-sourced; verify before enforcement. ## 4\. Mitigation & containment No affected product version, vendor patch or configuration fix is identified. Controls should focus on verifying institutional exposure and containing any trust path connected to the university. ### P1, within 24 hours - Determine whether the institution has University of New Mexico guest accounts, cross-tenant access, service principals, federated authentication, VPN connections, managed file transfers, research partnerships or supplier relationships. - Preserve Entra sign-in, audit and application-consent logs, together with VPN, email gateway, EDR and data-loss prevention telemetry covering UNM-linked identities and connections. Record the available retention period before beginning the review. - If an UNM-linked identity or integration shows suspicious activity, disable that identity or connection, revoke active sessions and rotate the associated passwords, API keys, client secrets and certificates. - Suspend non-essential data transfers through a confirmed UNM trust path until its owner and purpose have been revalidated. Do not block infrastructure based only on the BYOD name or the unverified claim. ### P2, within 72 hours - Ask the university or the responsible service provider for confirmation, affected time ranges, compromised identifiers, known access paths and validated indicators. Treat any new indicator set as unverified until its origin and scope are established. - Review Entra cross-tenant access policies, guest accounts, enterprise applications, service principals and OAuth consent grants associated with UNM. Remove unused objects and restrict remaining access to required applications and data. - Search authentication telemetry for unexpected locations, unfamiliar devices, repeated token use, new application consents and sign-ins outside the established pattern of each UNM-linked identity. - Review outbound transfers and mailbox activity associated with those identities for unusual volumes, forwarding-rule changes, bulk downloads or access to sensitive client records. ### P3, within 7 days - Replace persistent shared credentials with separately attributable accounts and short-lived authentication where an UNM relationship still requires access. - Test revocation of each cross-tenant trust, service principal and data-transfer route so that the institution can isolate the relationship without affecting unrelated services. - Document any confirmed client-side compromise, exposed data or operational disruption. Legal and regulatory teams should assess applicable notification duties only if evidence establishes an incident within the institution’s scope. - Retain relevant evidence and record why each account, integration or connection was disabled, retained or restored. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ## 6\. Detection Insufficient indicators to author detection rules. ## 7\. Sources - Ransomware.live, “Victim: University of New Mexico: BYOD”, https://www.ransomware.live/id/VW5pdmVyc2l0eSBvZiBOZXcgTWV4aWNvQEJZT0Q=, 26 October 2026. ## 8\. Adverse Trace position We assess this as a low-confidence, single-sourced breach and extortion claim, not a confirmed ransomware incident. Attribution to BYOD is unconfirmed because the actor has no MITRE ATT&CK profile. No CVE has been assigned, so no CVSS score or severity, EPSS score, or CISA KEV exploitation state applies. Client impact is currently unsubstantiated and is limited to possible exposure through identities, integrations or data held in connection with the university. We will monitor for confirmation from the university, independent reporting, validated indicators and evidence of data publication or service disruption; any actor-supplied indicators remain single-sourced and must be verified before enforcement. --- [Read the original source →](https://www.ransomware.live/id/VW5pdmVyc2l0eSBvZiBOZXcgTWV4aWNvQEJZT0Q=?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*