On Monday, October 26, 2026, a cyberattack at the University of New Mexico Health Sciences Center (HSC) forced New Mexico's only Level I trauma center to divert ambulances. It also cancelled clinic appointments and outpatient surgeries across UNM Health and shut down classes at the university's four health sciences schools. UNM has confirmed a "cybersecurity event," brought in outside responders and notified state and federal law enforcement. It has not said what kind of attack it was. A new extortion group called Byod has listed UNM on its leak site. It claims to have compromised 36,000 systems and stolen Social Security numbers, student records and research data. UNM's own assessment says the attack reached only "some end-user devices" and "did not penetrate core systems or servers." The university and the attackers are giving very different accounts. The difference matters for everyone whose data might be exposed. By Tuesday afternoon, UNM said critical systems were back online and its hospitals were fully open.
What Happened
UNM's newsroom update gives this timeline. IT security teams spotted a threat and began containment at about 11 a.m. on Monday, October 26. UNM Hospital leadership activated its Emergency Operations Center to coordinate the response.
- 12:30 to 2:30 p.m. Monday: UNM Health diverted ambulances to other health systems in the area. The university says hospitals in Albuquerque and Santa Fe took in new patients. BankInfoSecurity describes the diversion as covering "all ambulance traffic" and says appointments were cancelled "for several hours."
- Rest of Monday: System outages forced UNM Health to suspend outpatient surgeries and appointments for the remainder of the day. Becker's Hospital Review reports that patients were told not to come to UNM facilities.
- 2:30 p.m. Monday: UNM Health started bringing systems back online in phases. Help Net Security reports that UNM made its first public statement around the same time.
- 10:27 p.m. Monday: UNM said UNM Hospital and Sandoval Regional Medical Center were open and that clinics would resume scheduled work on Tuesday, according to Becker's.
- 2:02 p.m. Tuesday, October 27: UNM said critical electronic systems were restored, ambulance traffic was back to normal, and clinics had resumed scheduled appointments and procedures.
Two hospitals were affected: the 618-bed UNM Hospital in Albuquerque and the 65-bed Sandoval Regional Medical Center in Rio Rancho (BankInfoSecurity). BankInfoSecurity reports that the incident also affected the UNM Health System's IT systems for delivering clinical care.
The academic side was also hit. On Monday, students and nonessential, non-clinical staff at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health were sent home. On Tuesday, all HSC classes were cancelled, including online classes, and nonessential staff stayed home. UNM says classes at the central and branch campuses were not affected, and it expects HSC academic and research programs to resume on Wednesday, October 28. The university says the case is under criminal investigation, which limits what it can share.
Estimates of UNM Health's size differ a little. Every report agrees on more than 1 million patient visits a year. Emergency room visits are put at 80,000 a year by BankInfoSecurity, citing the university, and at about 100,000 by nm.news, citing UNM HSC figures reported by Infosecurity Magazine.
What Was Taken
UNM has not confirmed that any data was stolen. Everything below comes from the attackers' own claims.
BleepingComputer first linked the attack to Byod after finding UNM on the group's leak site. Byod claims it compromised 36,000 systems across UNM's main campus and hospital environments. It says it reached Active Directory forests, Group Policy infrastructure, the "entire" Microsoft Entra tenant and two Oracle databases. BleepingComputer reports that Byod claims to hold:
- Social Security numbers for students and employees
- HR, payroll and Banner student records
- Internal emails
- Research data
- Hospital appointment data, patient information and Cerner EHR rosters
Reports disagree about patient data. BleepingComputer's list includes patient information and EHR rosters. nm.news, citing threat intelligence firm VenariX via Infosecurity Magazine, says the claim "does not specifically mention patient records." The Duke City Ledger quotes the listing as claiming "every student + employee PII (including SSNs)." It reports that on Monday night the listing showed UNM's name but no leaked data.
UNM's position conflicts directly with Byod's. The university says only some end-user devices were affected and that core systems and servers were not breached. If that is accurate, a claim of domain-wide and Entra-wide compromise is either exaggerated or describes access UNM had not yet found when it published its update. Neither account has been independently verified. No regulator filing or breach notification has been published yet. If patient data turns out to be involved, a filing with the HHS Office for Civil Rights would follow.
Why It Matters
Disrupting trauma care is the pressure point. UNM Hospital runs New Mexico's only Level I trauma center and is the state's only academic medical center. Even a two-hour ambulance diversion moves the state's most seriously injured patients to other hospitals. Extortion groups know that outages like this create pressure to pay quickly.
The two accounts are far apart. The university reports a contained incident limited to end-user devices. The attackers claim control of the identity infrastructure behind the whole university. Defenders should treat the gap as a warning about the early stages of an incident. Organisations often report scope before forensics are finished, and attackers routinely exaggerate. Affected students, staff and patients cannot yet know which account is right.
Byod is new and has a short track record. The Duke City Ledger reports that security company WatchGuard first saw Byod in September 2026 and says its leak site "looks exactly like" one run by another new group, UmBra. According to ransomware.live, Byod listed eight earlier victims before UNM, all companies, including Trump Mobile, T-Mobile and the crypto exchange Gate. None was a hospital or school. The Ledger says three earlier listings had disappeared from Byod's site by Monday night, with no reason given. The group's FAQ says plainly, "The motive is to be paid." It accepts only Bitcoin or Monero and tells victims not to contact police. BleepingComputer reports that Byod offered to remove the UNM post once the university started negotiating.
Universities with medical centers are attractive targets. One environment holds student records, payroll, research data and clinical systems. A combined academic and health network gives an extortion group several kinds of data to threaten with, and a clinical outage to use as leverage.
The Attack Technique
UNM has not disclosed how the attackers got in, and no technical indicators have been published.
Byod's claims point to identity infrastructure as the main target: Active Directory, Group Policy and Microsoft Entra. An attacker who controls Group Policy can push malware to every machine joined to the domain. That would fit the scale Byod claims, though UNM disputes the scope.
The only clue to Byod's methods comes from an earlier case. The Duke City Ledger, citing The Register, reports that Byod leaked data on 3,615 Trump Mobile customers. Byod claimed it got in through password-stealing malware on the computer of a worker at a partner company. That is the group's own account, and it may not apply to UNM. Still, stolen credentials from contractor or third-party devices are a likely starting point for a group that targets identity systems.
WatchGuard describes Byod as a group that steals data and threatens to publish it, according to the Duke City Ledger. Whether Byod actually encrypted UNM systems or only stole data has not been confirmed. UNM's description of system outages and phased restoration is consistent with either encryption or defensive shutdowns.
What Organizations Should Do
- Lock down identity systems first. Audit who has administrative rights over Active Directory, Group Policy and Entra. Use separate admin accounts and dedicated admin workstations. Alert on any changes to Group Policy objects, since these are a common way to push malware across a whole domain.
- Look for credentials stolen by infostealer malware, including contractors'. Monitor for your organisation's credentials in infostealer logs. Require phishing-resistant MFA for third-party and contractor access, and reset sessions and tokens, not just passwords, when an exposure is found.
- Separate clinical networks from academic and business networks. Segment EHR, imaging and other clinical systems so that a compromise on the university side cannot force ambulance diversion. Rehearse running on paper and diverting ambulances with nearby hospitals before you ever need to.
- Find and protect high-value databases. Locate where SSNs, payroll, HR and student records are stored, including Oracle and Banner. Restrict who can access them, and alert on large exports or unusual database queries.
- Test recovery of identity systems, not just data. Keep offline, immutable backups of Active Directory and practise a full forest recovery. Phased restoration only works if you can trust your identity systems again.
- Confirm scope before you make public statements. Avoid early statements that rule things out, such as "core systems were not penetrated," until forensics confirm them. If the attacker's claims later prove true, the walk-back damages trust with patients, students and regulators.
Sources: UNM Health ransomware attack disrupts patient care, surgeries | Cyberattack Disrupts New Mexico's Only Trauma Center | Cyberattack disrupts University of New Mexico hospitals, extortion... | UNM Health restores systems, reopens clinics after cyber incident | Cybersecurity issue knocks out a major New Mexico hospital network... | Update on Cybersecurity Event at UNM Health Sciences Center UNM HS... | Ransomware group claims UNM hack as health clinics reopen - nm.news | The gang claiming UNM hack also claimed Trump Mobile hack Duke Cit...