Hospital Diverts Ambulances, 5.7M Breached by a Phone Call, Town Pays $82K Ransom

Ransomware forced the only Level 1 trauma center in New Mexico to turn ambulances away for two hours. In trauma care, minutes matter. If a hospital that size can be pushed to the edge, what happens to your business on its worst Monday?
You decide how a breach goes before it happens, not after.
Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to track cyber news but can't afford to be blindsided by it.
First, the University of New Mexico Health System. On a Monday in late October, ransomware hit the state's only Level 1 trauma center. Ambulances were diverted, surgeries suspended, and students sent home. A brand-new group calling itself Byod claims it reached 36,000 systems and stole patient, payroll, and health records. UNM has not confirmed any theft and is letting the FBI run forensics first. Byod has only a handful of claimed victims. It doesn't take a famous gang like LockBit to take down a hospital. Here's the part worth copying: clinics were back the next morning because the recovery plan already existed. Tested backups and a rehearsed plan were in place before the attack, not improvised during it.
Then there's Marathon Health. Nearly 5.7 million people are being notified because of one phone call. Someone posed as Marathon's own IT team, talked an employee out of their password, logged into a cloud app, and exported the database in a few hours. Marathon runs health centers for over 600 employers across 41 states. That's why the victim count dwarfs its own patient list of roughly 3 million. Two law firms opened investigations within two weeks, and Marathon is now on the hook for up to two years of credit monitoring for every one of those 5.7 million people. The breach is a bad week. The lawsuits and that monitoring bill are the bad three years.
Finally, the Town of Bernalillo, New Mexico. Its council voted in a public meeting to offer $82,000 to the attacker who locked up town systems. As of the reporting, the town had not paid. It had no guarantee of getting anything back and no timeline for returning to normal. Here's what many owners miss: the U.S. Treasury has warned since 2020 that paying a ransom can itself break sanctions law. It's strict liability, meaning you can be fined even if you had no idea who the attacker was. Pay the wrong party and a victim becomes a federal violator, with penalties that can top $356,000 per violation. Reporting the attack to the FBI first is an explicit way to lower that risk.
Three different stories, one decision: prepare before the attack, not during it.
In this episode, we discuss:
• A ransomware attack that forced New Mexico's only Level 1 trauma center to divert ambulances
• The Marathon Health breach that exposed nearly 5.7 million people after a single phone call
• Why the Town of Bernalillo voting to pay an $82,000 ransom runs straight into a federal warning
• Why paying a ransom can be illegal under U.S. Treasury sanctions rules
• How tested backups and a rehearsed plan decide whether you recover in a day or a month
• The one move that lowers your legal risk if you are ever forced to consider paying
Security Squawk is a weekly podcast and live stream for business owners and executives.
Support the show: buymeacoffee.com/securitysquawk
Subscribe | Like | Share
#SecuritySquawk #CyberSecurity #Ransomware #DataBreach #Healthcare #SocialEngineering #VendorRisk #OFAC #SmallBusiness #BusinessRisk #MSP #IncidentResponse