UNM Health resumes care; BYOD data theft claim remains unconfirmed
A cyberattack detected on October 26, 2026 took down systems at UNM Health in New Mexico, which diverted ambulances for about two hours, canceled surgeries and closed more than 30 clinics. Hospitals reopened later on October 26 and clinics resumed regular appointments on October 27; academic and research units remain closed and the FBI is assisting the investigation. Ransomware group BYOD claimed the attack and alleges it compromised 36,000 machines and stole patient, student and employee data; UNM has not confirmed any theft.
What happened
A cyberattack detected on October 26, 2026 took down systems at UNM Health in New Mexico. The hospital diverted ambulances for about two hours, canceled surgeries and appointments, and suspended care at more than 30 clinics. Hospitals reopened later on October 26 and clinics resumed regular appointments on October 27.
Why it matters
The network handles about 900,000 outpatient visits and 100,000 emergency room visits per year and runs the state's only Level 1 trauma center, so the outage put patients at direct risk. Group BYOD claims it compromised 36,000 machines and stole patient, student and employee data, including Social Security numbers; UNM has not confirmed. Academic and research units remain closed and the FBI is assisting the investigation.
What to do
Follow official UNM statements, reschedule canceled appointments, and do not contact the hackers, as the university asked. Patients, students and staff should watch for formal notices about their data while the theft claim remains unconfirmed.
For the technical team
- Affected
- University of New Mexico Universidade do Novo México (UNM) e seu sistema de saúde (UNM Health System); hospital em Albuquerque, único centro de trauma nível 1 do estado, e mais de 30 clínicas · University of New Mexico and UNM Health System: UNM Hospital in Albuquerque (state's only Level 1 trauma center, only burn unit and only children's hospital), more than 30 clinics, and the entire Health Sciences Center, including the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health. The center had 2,670 students enrolled in 2025 (Infosecurity).
- Exploitation
- Data theft is an unverified gang claim. BYOD took credit on October 26 via its data leak site, listing relayed by VenariX; it claims 36,000 machines compromised and exfiltration of student and employee PII (including SSNs), research data, records and internal emails. DailyDarkWeb notes only the service disruption is confirmed; actor, cause and any data theft unverified. BYOD is a new gang that emerged the previous month, with few named victims (The Record).
- Fix
- No product fix applies. UNM containment and recovery: IT containment, federal law enforcement notified, temporary ambulance diversion, same-day appointment cancellations and limited new patient admissions; staff told to shut down and unplug desktops and disconnect mobile devices from hospital Wi-Fi. Systems restored in phases from 2:30 pm on October 26; all hospitals open and clinics on regular schedules from October 27; academic and research units closed on October 27.
- Vector
- Initial vector not disclosed; UNM would not comment on whether ransomware was involved (The Record). The incident caused loss of access to critical electronic systems across the entire Health Sciences Center: hospital, academic campus and research facilities. Staff reported messages displayed across computers claiming theft of student, employee and patient data (AP/SecurityWeek).
- More details
- Detection and disclosure on October 26, 2026, with updates at 2:30 pm and 10:27 pm MDT. Ambulances diverted for about two hours to systems in Albuquerque and Santa Fe; Presbyterian Healthcare Services and Lovelace Health System took extra patients. Health sciences students and non-essential staff sent home; classes canceled at the four health schools, including online. BYOD's post claims compromise of both Active Directory forests (main campus and hospital sector, with GPOs), two Oracle databases, the entire Entra tenant, Oracle HR and payroll, Banner records and Cerner EHR rosters, and threatens to take the institution down once communication is established. Tufts professor Josephine Wolff called playing a message on compromised computers unusual. Second major attack on a US state hospital this year after University of Mississippi Medical Center in March (The Record). FBI assisting; the active investigation limits what UNM can share.
Timeline
UNM restored hospital systems after an attack that forced ambulance diversion and canceled medical school classes; the university urges people not to contact the hackers.
Coverage of the UNM attack reports it began at 11:30am and that on-screen messages claimed access to students' and employees' personal data, including Social Security numbers.
UNM Health details its response: the attack was detected on October 26, prompting temporary ambulance diversion to alternative hospitals and cancellation of all appointments that day, while new patient intake was limited.
Want the next updates in your inbox? Get the daily edition →
See all 13 updates
New reports describe diverted ambulances and ransom demands broadcast over the hospital's sound system.
BleepingComputer details that ransomware has disrupted surgeries and patient care at UNM's health system.
BYOD group offers a free decryption key for hospital-sector devices and pledges to pay $2,500 to each affected patient with proof.
The BYOD ransomware group claims the attack; UNM Health cancels surgeries and diverts ambulances while working to restore systems.
The hospital diverted ambulances for about two hours to health systems in Albuquerque and Santa Fe and suspended outpatient surgeries and appointments for the rest of the day.
UNM says its hospitals are open and all clinics will resume regular appointments and procedures on October 27; classes at its four health-sciences schools remain canceled as security teams still work to resolve the incident.
UNM Health began phased restoration of systems and operations on Oct. 26 after temporarily limiting new patient intake; academic units remain closed and the FBI is assisting.
Post ties the ambulance diversions and cancellations to the Oct 26 incident and adds that non-essential staff and students were sent home while Presbyterian Healthcare Services takes in extra patients; the hospital houses New Mexico's only Level I trauma center.
UNM's main Albuquerque hospital began diverting patients and more than 30 clinics canceled appointments due to the incident.
BYOD group named the university on its leak site and detailed the alleged network access.
Sources 9 sources
- @DarkWebInformer @DarkWebInformer
- Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics SecurityWeek
- @DailyDarkWeb @DailyDarkWeb
- @DailyDarkWeb @DailyDarkWeb
- @DailyDarkWeb @DailyDarkWeb
See all 13 sources
- University of New Mexico hospital diverts ambulances after cyberattack The Record
- Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances Infosecurity Magazine
- @DarkWebInformer @DarkWebInformer
- @BleepinComputer @BleepinComputer
- @mattjay @mattjay
- University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack HIPAA Journal
- @AISafetyMemes @AISafetyMemes
- University of New Mexico restores hospital systems, urges no contact with hackers The Record
