Western New Mexico University cyberattack

Malware that encrypts systems or data, typically accompanied by a ransom demand.

Threats to publish or sell stolen data without evidence of encryption.

Unauthorized access to systems, accounts, networks, or data.

An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

A service, system, platform, or operational capability remained available only in part or with significant limitations.

Internal or external network connectivity was unavailable or materially impaired.

The organization lost or materially restricted internet connectivity.

Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

A public-facing website was unavailable, disabled, or inaccessible.

A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.

Internal business, administrative, operational, or staff-facing systems were unavailable.

A specific application or software platform became unavailable or unusable.

VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.

The organization could not process, receive, issue, reconcile, or record payments normally.

Staff, customers, patients, students, residents, or other users could not access records or case information normally.

Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

Services continued but with longer processing, response, delivery, or completion times.

Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.

The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.

The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.

The actor explicitly threatened to publish or publicly release victim data or incident details.

The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.

A dedicated portal, chat system, or communication channel was used for ransom negotiation or victim instructions.