UNM Health Cyberattack Disrupts Emergency Care and Surgeries as Ransomware Group Claims Massive Breach
A cyberattack against the University of New Mexico Health Sciences Center (UNM HSC) forced hospitals to divert ambulances, cancel outpatient surgeries, and suspend medical appointments, highlighting how cybersecurity incidents can quickly disrupt essential healthcare services.
The incident began on October 26, 2026, affecting clinical operations, academic activities, and electronic systems across the university's health sciences environment. Although UNM Health restored critical systems within approximately a day, the attack raised concerns about the resilience of healthcare infrastructure and the potential exposure of sensitive patient information.
A relatively new ransomware group known as Byod claimed responsibility, alleging that it compromised approximately 36,000 systems and obtained access to extensive university and hospital data. However, UNM has disputed the apparent scale of the intrusion, stating that its investigation found affected end-user devices but no penetration of core systems or servers.
The conflicting accounts remain central to understanding the incident. While the operational disruption has been confirmed, the attackers' claims regarding widespread network compromise and data theft have not been independently verified.
Cyberattack Forces Ambulance Diversions and Surgery Cancellations
UNM Health Sciences Center identified the cybersecurity threat on Monday, October 26, prompting information technology teams to begin containment measures at approximately 11 a.m. local time.
As security personnel worked to protect the network, hospital administrators activated an Emergency Operations Center to coordinate the response and maintain communication with clinical staff.
The disruption quickly affected patient care.
Between 12:30 p.m. and 2:30 p.m., UNM Health temporarily diverted ambulance traffic to other healthcare providers in the Albuquerque and Santa Fe areas. System outages also forced the cancellation of outpatient surgeries and medical appointments for the remainder of the day.
The organization temporarily limited new patient admissions while determining which systems could be operated safely.
The consequences were particularly significant because UNM Hospital operates New Mexico's only Level I trauma center, providing specialized treatment for patients with severe and life-threatening injuries.
Unlike ordinary business interruptions, outages affecting hospital systems can create immediate operational challenges. Clinical staff depend on electronic infrastructure for patient records, scheduling, communications, laboratory information, and coordination between departments.
Even when medical professionals remain available, disruptions to these supporting systems can prevent healthcare facilities from delivering services through their normal workflows.
UNM coordinated with other regional healthcare providers to accommodate patients during the interruption.
Hospital officials began restoring systems at approximately 2:30 p.m. on October 26, bringing services back online in stages after security teams determined that doing so was safe.
The organization subsequently confirmed that ambulance traffic had returned to normal and that hospitals and clinics had resumed their regular operations.
Academic and Research Operations Also Affected
The incident extended beyond hospital services into the university's academic environment.
UNM canceled classes at its School of Medicine, College of Nursing, College of Pharmacy, and College of Population Health. Nonessential Health Sciences Center employees were instructed to remain home while technical teams investigated the incident.
Classes remained canceled on October 27, although essential employees and clinical personnel continued working according to their operational responsibilities.
The broader University of New Mexico campus and its branch campuses were not subject to the same academic closures.
By October 28, UNM confirmed that classes and research activities at the Health Sciences Center had resumed and that clinical operations across its healthcare facilities were fully functional.
This recovery timeline illustrates the interconnected nature of academic medical centers, which often combine hospital operations, research laboratories, educational programs, and administrative services within complex technology environments.
Although these functions have different operational requirements, they may depend on shared infrastructure, authentication services, network connectivity, and endpoint management systems.
A cybersecurity incident affecting that infrastructure can therefore disrupt multiple activities even when the underlying intrusion does not compromise every system.
The case also demonstrates why healthcare organizations must coordinate incident response across clinical, technical, administrative, and academic teams rather than treating cybersecurity as an isolated IT problem.
Byod Ransomware Claims Compromise of 36,000 Systems
While UNM publicly described the event as a cybersecurity incident, BleepingComputer identified a ransomware group called Byod claiming responsibility through its data leak website.
The group alleged that it had compromised approximately 36,000 systems across the university's main campus and hospital environments.
According to the attackers, the intrusion provided access to major infrastructure components, including Active Directory environments, Group Policy systems, the organization's Microsoft Entra tenant, and two Oracle databases.
Byod also claimed to possess several categories of sensitive information:
Social Security numbers belonging to students and employees.
Human resources and payroll records.
Student information maintained through Banner systems.
Internal university communications and emails.
Research-related information.
Hospital appointment records and patient information.
Data associated with Cerner electronic health record systems.
These allegations, if substantiated, would indicate a serious compromise affecting both personal information and enterprise infrastructure.
However, the group has not provided independently verified evidence establishing the full extent of the claimed access, and UNM has not confirmed that the listed categories of information were stolen.
The distinction is especially important in ransomware reporting because criminal groups frequently make expansive claims to pressure victims into negotiations.
A threat actor's assertion that it controls an organization's entire infrastructure should not be treated as equivalent to a forensic finding.
UNM's own assessment presents a substantially narrower picture of the incident.
UNM Says Core Systems and Servers Were Not Compromised
In its October 27 update, UNM Health Sciences Center stated that security teams had determined the incident affected some end-user devices but had not penetrated core systems or servers.
The organization credited its internal IT security personnel and external partners with securing the network and restoring critical electronic services.
State and federal law enforcement agencies were notified, and the incident remained under criminal investigation.
These findings differ significantly from Byod's claims of extensive infrastructure compromise.
If UNM's assessment is accurate, the attackers' actual access may have been substantially more limited than the scope advertised on their leak site.
However, the university's statements do not provide a complete public forensic account of the intrusion. They do not identify the initial access vector, the specific malware involved, or the complete sequence of attacker activity.
The public information also does not establish whether any sensitive information was exfiltrated.
This uncertainty should be maintained when assessing the incident. The confirmed facts are that a cybersecurity threat affected some devices, caused operational disruption, and required emergency containment measures.
The alleged compromise of tens of thousands of systems remains unverified.
UNM also stated on October 28 that it had made no concessions to any group behind the threat.
That statement provides additional context for the organization's response, although it does not establish whether the attackers retained any information they may have obtained.
Ransomware Group Offers Decryption Keys and Patient Compensation
Byod's public statements included several unusual claims intended to distinguish the group from conventional ransomware operators.
After initially using its leak site to pressure the university into communication, the group said it would provide decryption keys for affected healthcare systems without payment.
It also claimed that it would compensate affected patients with payments of up to $2,500 each.
At the same time, the group stated that it intended to retain the allegedly stolen data.
These statements are contradictory from a victim-protection perspective. Offering decryption assistance does not eliminate the consequences of data theft, particularly when the attackers retain information that could potentially be used for fraud, identity theft, or further extortion.
There is no independently verified evidence that the group distributed the promised compensation or that patients received legitimate payments.
Byod describes its operations as a form of security testing intended to expose inadequate corporate security practices. However, unauthorized intrusion, data theft, and extortion are not legitimate penetration testing activities.
At the time of BleepingComputer's reporting, the group listed six victims on its data leak site and had allegedly published stolen information relating to three of them.
Its limited public history makes independent assessment of its capabilities and claims particularly difficult.
The group's statements should therefore be understood as unverified communications from a criminal actor rather than reliable evidence about the technical scope of the incident.
UNM Warns Patients About Secondary Fraud and Phishing
On October 28, UNM issued a public warning advising patients, students, employees, and community members not to engage with individuals or groups claiming responsibility for the cybersecurity incident.
The university cautioned that attackers might exploit public concern about the event by sending fraudulent messages or offering supposed compensation.
This warning was particularly relevant given Byod's claims about payments to affected patients.
Cybercriminals sometimes use the publicity surrounding a breach to conduct secondary attacks. A victim may receive a message claiming to provide compensation, identity protection, account verification, or additional information about exposed records.
Such messages can be used to collect personal information, steal credentials, or persuade recipients to download malicious files.
UNM advised individuals to avoid opening suspicious attachments, clicking unsolicited links, or providing financial information to anyone claiming involvement in the incident.
The university also recommended preserving suspicious communications and reporting them to the FBI's Internet Crime Complaint Center.
Importantly, the warning did not confirm that Byod had obtained the personal information it claimed to possess. It reflected a precautionary response to the possibility of follow-on fraud.
For patients and employees, the safest approach is to rely on official university communications and avoid responding directly to alleged attackers.
Why Hospital Cyberattacks Create Risks Beyond Data Theft
The UNM incident demonstrates that the immediate consequences of a cyberattack against a healthcare provider may involve service availability rather than confirmed data exposure.
A hospital does not need to suffer a complete network compromise for its clinical operations to be disrupted.
Security teams may need to isolate devices, disable network access, suspend applications, or restrict communications while investigating suspicious activity.
These containment measures can be necessary to prevent an incident from spreading, but they may also interrupt systems used by medical personnel.
In UNM's case, the confirmed consequences included ambulance diversions, canceled appointments, suspended outpatient surgeries, and temporary academic closures.
The disruption was relatively short, but it affected services that depend on reliable technology and coordinated operations.
Healthcare organizations face a particularly difficult balance during incident response. They must contain potential threats without unnecessarily interrupting essential treatment.
That challenge becomes more complicated when an organization operates specialized emergency services that may not be available at every nearby hospital.
Regional coordination is therefore a critical component of healthcare cyber resilience.
UNM's ability to divert patients to other providers and gradually restore services illustrates the importance of established emergency procedures, even though the incident still caused meaningful disruption.
The case also highlights the distinction between technical recovery and organizational recovery.
Restoring electronic systems does not automatically resolve questions about possible data exposure, attacker persistence, or the security weaknesses that enabled the initial incident.
Those issues require continued investigation after clinical services return to normal.
Security Lessons for Healthcare Organizations
The attack reinforces several priorities for hospitals, medical networks, and academic healthcare institutions.
Maintain clinical downtime procedures. Hospitals should be able to continue essential patient care when electronic systems are temporarily unavailable.
Prepare regional diversion arrangements. Coordination with nearby healthcare providers can reduce the impact of emergency department disruptions.
Segment critical systems. Administrative endpoints, research environments, and clinical infrastructure should have appropriate network boundaries.
Protect identity infrastructure. Privileged accounts, directory services, and cloud identities require strong authentication, monitoring, and restricted permissions.
Test incident response plans. Exercises should involve clinical leadership, emergency management teams, IT personnel, and external partners.
Verify backups and recovery procedures. Organizations need reliable methods for restoring affected systems without reintroducing an active threat.
Monitor for secondary fraud. Security communications should warn patients and employees about phishing attempts that exploit publicity surrounding an incident.
Distinguish allegations from verified findings. Threat actor claims should be evaluated against forensic evidence before being presented as established facts.
Healthcare organizations should also maintain accurate inventories of devices and systems supporting essential clinical operations.
Knowing which applications are necessary for emergency care, patient scheduling, diagnostic services, and medical records can help incident responders prioritize restoration efforts.
The objective is not only to prevent intrusions but also to preserve patient safety when preventive controls fail.
Rapid Recovery Does Not Eliminate the Need for Investigation
UNM Health restored critical electronic systems on October 27 and confirmed the return of normal clinical and academic operations by October 28.
That recovery limited the duration of the disruption, but it did not immediately resolve the conflicting accounts surrounding the incident.
Byod claimed a compromise involving tens of thousands of systems and extensive sensitive data. UNM reported that the event affected some end-user devices without penetrating its core infrastructure.
The available public evidence does not establish which account fully reflects the attackers' access or whether the alleged data theft occurred.
What is confirmed is that the incident interrupted essential healthcare services at an institution operating New Mexico's only Level I trauma center.
The broader lesson is that the operational impact of a healthcare cyberattack can be serious even when the extent of the underlying compromise remains uncertain.
For hospitals and healthcare networks, cybersecurity resilience must therefore include both protection against intrusion and the ability to sustain patient care during unexpected technology failures.
The UNM incident illustrates the value of rapid containment, coordinated emergency response, and phased recovery, while reinforcing the need for continued investigation and transparent communication when ransomware groups make unverified claims about sensitive information.