New Mexico Highlands University
New Mexico Highlands University ransomware attack
Summary
An April 2024 ransomware attack disrupted New Mexico Highlands University’s network, portal and campus communications, prompting extended class cancellations. Payroll access and emergency-contact systems were also affected; a complete restoration date remains unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Remote access disruption
VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.
-
Emergency communications disruption
Emergency notification, public warning, radio, alerting, 911, or emergency coordination communications were unavailable or impaired.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
New Mexico Highlands University reported portal-authentication problems and canceled classes beginning April 3, 2024. Its emergency updates confirmed ransomware on April 5. The university isolated affected systems and brought in specialists, establishing a disruptive cyberattack.
Operational significance
The outage interrupted teaching, campus connectivity and access to staff systems across the main campus and four centers. Campus police communications initially required alternative emergency numbers. Employees received assistance with time reporting and payroll access; this does not mean pay stopped. A later corrective-action report explicitly says payroll was processed during the attack.
The university announced an April 15 restart, but its updates still described unavailable time clocks and incomplete Farmington recovery. Returning classes did not establish restoration of every system. Financial Planning Committee minutes later reported that remote accountants could not access Banner through the VPN until late May, delaying reconciliations and closing the books. That month-level account does not supply an exact restoration day.
Confidence and uncertainty
Confidence in ransomware and substantial educational disruption is high. No responsible group or confirmed data theft was established in the reviewed victim evidence. Claims about other institutions or the university’s separate 2019 attack do not identify the attacker here.
The incident is presumed resolved, supported by restored teaching and subsequent confirmation that VPN access returned. An exact date for complete recovery remains unverified.
Analytic gaps
The entry method, number of affected systems, extent of any information exposure, precise restoration dates for individual services and final recovery costs remain unresolved. Later accounting delays should not be described as a continuous universitywide technical outage through November.
Organizations involved
Impacted locations
Albuquerque, New Mexico
Albuquerque hosts an NMHU center affected by the university’s network disruption and class cancellations.
Farmington, New Mexico
Farmington hosts an affected NMHU center. The university’s April 14 update said restoration there was still pending.
Las Vegas, New Mexico
Las Vegas, New Mexico, hosts the university’s main campus, where the attack disrupted teaching, network access and administrative systems.
Rio Rancho, New Mexico
Rio Rancho hosts an NMHU center affected by the university’s network disruption and class cancellations.
Santa Fe, New Mexico
Santa Fe hosts an NMHU center affected by the university’s network disruption and class cancellations.
Sources
The portal needed for classes was unavailable after the April 3 issue. Classes were canceled and staff arranged alternative assistance for payroll access while investigating the attack.
NMHU canceled classes and lost access to network and staff systems, including campus emergency communications. Phone service returned before internet and VPN access; payroll assistance was arranged.
Classes were canceled through April 14 because several systems, including MyNMHU, remained offline. The university planned to preserve the scheduled semester end and commencement dates.
Dated updates confirm ransomware, class cancellations and staged restoration. An April 15 reminder says time clocks remained offline; April 14 announced a restart while Farmington restoration was still pending.
The committee reported that the April attack delayed closing the books because remote accountants lacked Banner VPN access until late May. Other staffing and audit issues also contributed to delays.
The university states payroll was processed during the ransomware attack. Loss of VPN access delayed capital-asset and account-reconciliation work; the report says VPN access had been restored.
See something that needs correction?
Signed-in members can report an error, update, or missing source.