All Articles

TL;DR for CISOs: The University of New Mexico Health Sciences Center diverted ambulances and cancelled clinics on October 26 after a cybersecurity event, and an extortion group's claims about the scale remain unverified. Japan's GMO Internet says it will not pay a reported 8 billion yen demand after an intrusion into its Onamae Desktop Cloud service. Sony Network Communications disclosed a 2,585,481-record customer data exposure that includes email credentials.

Today's slate at a glance

Lead story: UNM Health Sciences Center restores care after a cyberattack, while an extortion group makes unverified claims

Key facts

What happened

UNM's Health Sciences Center disclosed a cybersecurity event on October 26 that led it to divert ambulances, suspend outpatient care and cancel academic activity. The center runs the state's only Level I trauma center, so the diversion pushed patients to neighboring systems in Albuquerque and Santa Fe. Staff communications reported by Help Net Security describe an instruction to shut down and unplug computers within roughly 40 minutes of detection.

By Tuesday afternoon UNM reported that critical systems were back and clinics had resumed. The same day, an extortion group posted claims about the scale of the intrusion. Journalists covering the story note that a claim of responsibility does not confirm that the group was responsible or that ransomware was deployed, and UNM has not responded to questions about the claims.

Evidence

• BleepingComputer: UNM Health ransomware attack disrupts patient care, surgeries
• Help Net Security: Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack
• UNM HSC Newsroom: update on cybersecurity event
• The Register: Day 2 of cancelled classes at University of New Mexico

What this means for your team

The most useful fact in this story is how quickly the organization chose to isolate. Shutting down end-user devices within an hour limited the reach into core systems, according to UNM's own assessment, but it also meant ambulances were diverted. That trade-off is a decision your leadership should make in advance, with clinical or operational owners in the room, rather than improvise while the network is degrading.

The second lesson is communications discipline. An extortion group published large figures while the victim was limiting what it could say. Security leaders in that position need a pre-agreed rule for how to respond to claims: confirm what is verified, state what is not yet known, and avoid repeating attacker numbers as fact. Boards and regulators will ask for both the operational facts and the data-exposure facts, and they are rarely available at the same time.

Action checklist

1. Run a tabletop that forces the shutdown-and-unplug decision, and record who has authority to order ambulance or service diversion.
2. Confirm that endpoint management and identity infrastructure (Active Directory and Entra) have separate administrative paths, so a compromised workstation estate cannot reach tenant-level controls.
3. Check that offline copies of clinical or operational downtime procedures are current and printed where staff can find them.
4. Write a one-page claims protocol: who verifies attacker assertions, what the public line is, and when law enforcement approves wording.

Supporting story: GMO Internet refuses a reported 8 billion yen demand after the Onamae Desktop Cloud intrusion

Key facts

What happened

GMO Internet, one of Japan's large internet service companies, first said unauthorized programs were present on customer servers on October 20. It shut the service down in stages, and by October 24 it was offering customers compensation and replacement machines. On October 27 BleepingComputer reported that GMO had asked customers to back up their data and then power down PCs, and that the attacker was threatening to trigger a payload planted earlier. GMO said it is working with Trend Micro to scan systems.

TechCrunch reports that GMO did not respond to its request for comment and that the full extent remains unclear. Neither outlet names a confirmed ransomware group in the reporting reviewed. GMO's earlier coverage in our October 21 edition described the initial intrusion; this item covers the escalation.

Evidence

• TechCrunch: Japan internet giant GMO says hackers posted stolen customer data
• BleepingComputer: Japan's GMO urges customers to shut down PCs amid ransomware threat
• BleepingComputer: Onamae Desktop Cloud hacked, up to 27,000 servers affected

What this means for your team

Hosted desktops concentrate risk. When a provider's environment is compromised, every customer's stored credentials, sessions and applications are in scope at once, and the customer cannot patch their way out. Trading and finance teams that run workloads on hosted desktops should treat provider access to those machines as part of their own attack surface.

The refusal to pay also matters for planning. A provider that declines an extortion demand can expect the data to be published, which leaves customers dealing with exposure and phishing rather than a negotiated outcome. Decide in advance how your organization would respond to a published list that includes your users.

Action checklist

1. List every hosted desktop, VPS or virtual workstation service your teams use, including those bought outside central IT.
2. Rotate credentials stored on provider-hosted machines, and end active sessions for trading, treasury and admin accounts.
3. Ask critical providers how they isolate customer environments from each other and from the provider's management plane.
4. Brief finance and operations staff that providers do not request passwords or card details by email or phone.

Supporting story: Sony Network Communications discloses 2,585,481 So-net and plala customer records exposed

Key facts

What happened

Sony Network Communications said an unauthorized party accessed its systems on October 19. It found the intrusion on October 23, stopped the affected servers, blocked the source and confirmed on October 24 that information had leaked. The company reset the affected email passwords on October 27 and reported the incident to Japan's Personal Information Protection Commission.

Sony says it has seen no resulting harm so far, but it warned customers to expect suspicious messages. Reporting also states that no connection has been established with an earlier Sony MOVEit-related breach, which involved a different company unit.

Evidence

• CyberInsider: Sony discloses data breach exposing 2.6 million customer records
• Cyber Security News: Sony data breach, 2.58 million So-net and plala users

What this means for your team

The profile data here is a ready-made phishing kit. Names, birth dates and phone numbers let an attacker write a believable message, and the exposed email credentials may let one read or send from a real mailbox, although reporting does not show that any mailbox was accessed. Sony has not said how the email passwords were stored, and that detail will decide how long the exposure lasts.

For enterprises, the risk is indirect: employees who use personal accounts with Sony's Japanese services, and any vendors in Japan that share addresses with business contacts. A single known intrusion window also gives defenders a fixed start date, October 19, for retrospective checks.

Action checklist

1. Warn staff and executive assistants in Japan and APAC to treat messages that mention So-net, plala or password resets as suspect.
2. Review how your own customer mail and identity systems store credentials, and whether a mailbox password can be exposed without MFA.
3. Confirm email security tooling flags impersonation of known brands, and add the Sony notice wording to your phishing reporting examples.
4. Ask Japanese suppliers whether they hold So-net or plala addresses for your contacts.

Also notable

• Ohio Auditor of State Keith Faber said an overseas cyberattack hit the office web server on October 25, disrupting online accounts and payments. He said it was not ransomware, backups were intact and no evidence shows Ohio residents' personal financial information was accessed. Source: ABC6 On Your Side

Frequently asked questions

What has UNM confirmed about its cyberattack?

UNM confirmed a cybersecurity event on October 26 that affected some end-user devices, diverted ambulances, and cancelled clinics and classes. It says the event did not penetrate core systems or servers. It has not described the type of attack.

Is the Byod claim about 36,000 UNM machines verified?

No. The figure comes from the group's leak-site post. Reporting notes that a claim of responsibility does not confirm the group was responsible, or that ransomware was used, and UNM has not confirmed the claims.

Did GMO Internet pay the ransom demand?

GMO said it will not pay. The reported demand was about 8 billion yen, roughly $50 million. The company said it will pursue legal action against those who spread the published information.

What did Sony say was exposed?

Sony Network Communications said 2,585,481 records were exposed, including names, contact details, dates of birth and passwords for 54,401 email addresses. It says main membership passwords and credit card data were not involved.

How should a CISO treat attacker claims published on leak sites?

Treat them as allegations. Record them, compare them with what the victim organization has confirmed, and avoid repeating unverified numbers. Use them to test your own exposure rather than to draw conclusions about the victim.

Where can I follow more breach analysis?

The CISO Platform Breach Intelligence hub carries each daily edition, and the weekly newsletter summarizes the week.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.