UNM Health Ransomware Attack Diverts Ambulances And Halts Surgeries

The University of New Mexico Health Sciences Center (HSC) disclosed a cyberattack that disrupted patient care, diverted ambulances, and canceled classes across its campus. The incident began on Monday, October 26, 2026, when information technology security teams identified a threat and launched containment efforts around 11 a.m.

A new ransomware group called Byod later claimed responsibility, alleging it had compromised tens of thousands of systems and stolen sensitive personal data. UNM Health restored its critical electronic systems by Tuesday afternoon, but the university has not yet confirmed the gang's claims of data theft.

UNM Health serves as the clinical arm of UNM Health Sciences and runs New Mexico's only academic medical center alongside the state's largest teaching hospital. The health system records more than one million patient visits every year and delivers over 40 adult and pediatric specialty services throughout the state. Its flagship facility, UNM Hospital in Albuquerque, houses the only Level I Trauma Center in New Mexico, a designation it first earned in 1983.

The trauma center treats roughly 7,000 critically ill or injured patients annually, while the hospital handles about 93,000 emergency visits and 18,000 surgeries. According to UNM Health, the nearest alternative Level I trauma center lies more than 400 miles away, so the facility serves a vast rural population.

UNM Health published its first public notice at 2:30 p.m. on Monday, warning patients not to visit any of its facilities that day. The provider diverted all ambulance traffic to other hospitals, canceled all clinic appointments, and urged people to call 911 in any medical emergency.

Officials instructed nonessential personnel and students at the School of Medicine and three health sciences colleges to leave campus for the rest of the day. The affected colleges included the College of Pharmacy, the College of Nursing, and the College of Population Health, which together share the HSC campus. Hospital leadership activated an Emergency Operations Center to coordinate the response and to guide employees, students, and frontline clinical teams through the disruption.

A later update clarified that UNM Health diverted ambulances and limited new patient admissions between 12:30 p.m. and 2:30 p.m. on Monday. Health systems in Albuquerque and Santa Fe absorbed the redirected patients, and UNM thanked these partners for ensuring that patients received safe care. System outages forced the provider to suspend outpatient surgeries and appointments for the remainder of the day, and care teams pledged to reschedule them. Starting at 2:30 p.m., UNM Health brought its systems back online in phases, restoring each component only when security teams deemed it safe.

By late Monday evening, UNM Health confirmed that UNM Hospital and Sandoval Regional Medical Center remained open to patients despite the ongoing incident. The provider announced that all clinics would resume regularly scheduled appointments and procedures on Tuesday, October 27, after Monday's disruption. However, the university kept classes at its four health sciences schools canceled on Tuesday and asked nonessential HSC employees to remain at home. Classes at the UNM Central and branch campuses continued as normal because the cybersecurity event did not affect academic operations.

Byod Ransomware Gang Claims the Attack

UNM Health has not disclosed the nature of the cyberattack, but BleepingComputer discovered that a new ransomware operation named Byod had claimed responsibility. The threat actors listed UNM on their data leak site and boasted that they had compromised 36,000 systems across the main campus and hospital environments. According to the gang, the intrusion reached Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two separate Oracle databases.

The attackers also claimed that they stole a wide range of personal and institutional data belonging to students, employees, and patients, including the following:

• Social Security numbers (SSNs)
• Human resources and payroll records
• Banner student records
• Internal email communications
• Research data
• Hospital appointment data and patient information
• Cerner electronic health record (EHR) rosters

yod initially threatened to keep the breach post online until the university opened communications, a tactic that ransomware gangs commonly use to start ransom negotiations. BleepingComputer contacted UNM Health Sciences about the data theft allegations, but the organization had not responded to the request at the time of publication. In a subsequent post, the gang offered free decryption keys for locked systems at healthcare facilities and promised up to $2,500 for every affected patient.

The cybercriminals framed this offer as an ethical gesture, insisting that "we have morals and we have a heart, we are not villains." Despite this message, Byod stated that it would retain all the stolen data, which undermines its claim to have acted with any genuine restraint.

Byod is a newcomer to the ransomware landscape and currently lists six victims on its data leak site, according to BleepingComputer. The gang has already published the allegedly stolen data of three victims, demonstrating its willingness to follow through on its extortion threats. On its FAQ page, Byod describes its operations as penetration testing that exposes security weaknesses and holds data controllers accountable for breaches.

The group claims that it selects targets after an initial assessment, focusing on executives who allegedly treat customers as mere sources of profit. Such justifications do little to offset the real harm that unauthorized intrusions and data leaks inflict on the people whose information attackers expose.

UNM Health Sciences Center announced on Tuesday afternoon that all critical electronic systems were back online and that all UNM Health hospitals were fully operational. Ambulance traffic returned to normal operations, and clinics resumed their regularly scheduled appointments and procedures following the previous day's disruption.

IT security teams worked with external partners to secure the network, and they notified both state and federal law enforcement agencies about the incident. Their assessment found that the event "affected some end-user devices but did not penetrate core systems or servers," which contradicts BYOD's sweeping claims. The university expects all HSC academic and research programs to resume normal operations on Wednesday, October 28, while the criminal investigation continues.

UNM officials have limited the information they share publicly, citing an active law enforcement investigation that restricts what they can currently disclose. Consequently, the public still lacks clarity on whether the attackers actually exfiltrated the patient, student, and employee data that Byod claims to hold. The gap between the university's assessment and the gang's assertions means that affected individuals should treat the threat of data exposure seriously.

The UNM Health incident highlights how ransomware attacks on healthcare providers can quickly ripple beyond IT systems, directly affecting patient safety and emergency response. Diverting ambulances away from the state's only Level I trauma center, even for two hours, places additional strain on neighboring hospitals and critically injured patients.

Hospitals hold vast amounts of sensitive data and depend on uninterrupted system access, which makes them attractive targets for financially motivated extortion groups. UNM Health's rapid containment and phased recovery limited the disruption to roughly one day, demonstrating the value of effective incident response planning.