UNM Health Sciences Center cyberattack: ambulances diverted, BYOD ransomware group claims breach

What happened

UNM said the Health Sciences Center, which includes the UNM Health clinical delivery system, experienced a “cybersecurity event” on Monday, October 26, 2026. Its security teams took steps to contain the event, notified state and federal law enforcement, and brought in external partners (The Register).

The disruption was significant:

• UNM disclosed the incident at 2:30pm MDT on October 26 and cancelled all appointments for the rest of the day, including scheduled surgeries. Patients were told to use 911 for emergencies (Infosecurity Magazine).
• Ambulances were diverted to other hospitals in Albuquerque and Santa Fe (The Register). The HIPAA Journal reports the divert lasted from 12:30 to 2:30 p.m. on October 26 (HIPAA Journal).
• UNM Hospital in Albuquerque is the only level 1 trauma center in New Mexico (HIPAA Journal).
• Students at the School of Medicine, College of Pharmacy, College of Nursing and College of Population Health were told to leave campus. Classes there were also cancelled on Tuesday, October 27, including online and remote classes. Classes at UNM Central and branch campuses were not affected (Infosecurity Magazine).

Recovery has been phased. A 10:27pm update on October 26 said all UNM Health hospitals had reopened and clinics would resume regular appointments and procedures from October 27 (Infosecurity Magazine). Nonessential HSC staff were asked to stay home (The Register). The HIPAA Journal reports that containment began around 11 a.m. on October 26 and was largely successful. Some end user devices were affected, but UNM says it kept the threat actor from reaching its core systems and servers (HIPAA Journal).

Attribution and claims (unverified). UNM has not commented on the nature of the attack. The Register notes a claim by a group does not prove it was responsible or that a ransomware payload was deployed (The Register). A newly formed ransomware group called BYOD (written Byod by the HIPAA Journal) claimed the attack:

• It claims it compromised 36,000 machines, both Active Directory forests, two Oracle databases, personal data of every student and employee, and internal emails (The Register).
• Infosecurity Magazine, citing VenariX, says the group listed UNM on its leak site and claimed student and employee PII, research data, student records and internal emails (Infosecurity Magazine).
• The HIPAA Journal adds claims of patient data, payroll information and Cerner EHR rosters. It also reports that the group later said it did not know UNM Health ran systems supporting real-time patient care. The group offered free decryption keys for the hospital sector, said it will keep the data, and offered patients up to $2,500 each (HIPAA Journal).

The group’s earlier claim about Trump Mobile customer data appears to have held up, according to The Register. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two may be the same (The Register).

Not confirmed: the initial access method, whether data was stolen, whether patient data was involved, and whether files were encrypted. The HIPAA Journal says it is too early to determine whether patient data was involved (HIPAA Journal). The incident is under criminal investigation.

Am I affected?

• Patients: HSC receives more than one million patient visits a year (Infosecurity Magazine). If you had an appointment or procedure on October 26, UNM said it will work with patients to reschedule. Whether your records were accessed is not confirmed.
• HSC students and employees: Disruption to classes and staffing is confirmed. Exposure of your personal data is claimed by the group but not confirmed by UNM.
• UNM Central and branch campus students: Classes were not affected (Infosecurity Magazine). The HIPAA Journal reports the group’s claim that systems at the UNM main campus were also compromised, which is not confirmed (HIPAA Journal).
• Other organizations: No indicators of compromise, CVEs or software vulnerabilities have been published in these sources, so there is no patch to apply. The initial access method is not confirmed.

What to do now

1. Use official UNM and UNM Health channels for appointment, class and staffing instructions. Follow current guidance, including that nonessential HSC staff may be asked to stay home.
2. If you missed an appointment or procedure, wait for UNM to contact you about rescheduling and verify the contact through an official number or site. Use 911 for emergencies.
3. Expect possible follow-up notices. Until UNM confirms what data was involved, treat unexpected emails, calls or texts about your data or compensation as suspicious. Do not respond to the group’s payment offers and do not click links in unsolicited messages.
4. As general precaution, if you are a patient, student or employee, watch your bank, credit and account activity, and change reused passwords. This is general hygiene, not a step the sources confirm is needed.
5. Defenders at healthcare and university networks: use this incident to check that Active Directory, database servers and endpoint isolation can be contained quickly. The sources say UNM’s rapid containment limited the attacker’s reach, but they do not give technical details.
6. Watch for updates from UNM, law enforcement or credible reporting on the investigation. Anything beyond the facts above is not confirmed.

Sources

• The Register: Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack
• Infosecurity Magazine: Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances
• HIPAA Journal: University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack