The University of New Mexico Health Sciences Center diverted ambulances and suspended outpatient surgeries on 26 October after a cybersecurity event. UNM says critical systems are back online. A ransomware group calling itself Byod has claimed the intrusion; the university has not confirmed that attribution.
What happened
According to the UNM Health Sciences Center newsroom (opens in a new tab), IT security teams began containment around 11:00 local time on Monday 26 October after identifying a cybersecurity threat. From 12:30 to 14:30 that day, UNM Health temporarily diverted ambulance traffic to other area health systems while teams worked to protect the network. System outages also required the suspension of outpatient surgeries and appointments for the remainder of the day. Leadership activated an Emergency Operations Center and notified state and federal law enforcement.
UNM Hospital in Albuquerque houses New Mexico’s only Level I trauma centre. For a two-hour window the state was without its usual destination for the most seriously injured patients, a point stressed in contemporaneous Associated Press (opens in a new tab) reporting. Clinics across the UNM Health System cancelled appointments for the day. Classes at the School of Medicine and the colleges of Nursing, Pharmacy and Population Health were cancelled on Monday and again on Tuesday; nonessential Health Sciences employees were told to stay home on Tuesday.
In an update timed at 14:02 on 27 October, UNM said critical electronic systems were back online, all UNM Health hospitals were fully open, ambulance traffic had returned to normal and clinics had resumed scheduled appointments and procedures. The university’s assessment is that the event affected some end-user devices but “did not penetrate core systems or servers.”
The Byod claim
UNM has not publicly named a ransomware family. BleepingComputer (opens in a new tab) reported that a new group calling itself Byod listed UNM on its leak site and claimed compromise of tens of thousands of systems across campus and hospital environments, including directory infrastructure, cloud identity and databases, plus access to student, staff and patient data. Treat those claims as unverified until UNM or investigators confirm them. Byod also posted that it would provide free decryption keys for healthcare facilities while keeping any stolen data, according to the same report.
What to do now
- Patients and staff in the UNM ecosystem: watch for phishing that references cancelled appointments, diverted ambulances or “account recovery” after the outage. UNM has advised vigilance for unsolicited communications.
- Peer hospitals: review divert and downtime playbooks. A two-hour divert of a Level I trauma centre is a regional event, not a local IT ticket.
- Healthcare defenders: assume credential and endpoint compromise first; do not take a ransomware group’s victim post at face value without independent confirmation from the covered entity.
Sources
- UNM HSC Newsroom — Update on Cybersecurity Event at UNM Health Sciences Center (opens in a new tab) (27 October 2026)
- Associated Press — Cybersecurity issue knocks out a major New Mexico hospital network (opens in a new tab) (26 October 2026)
- BleepingComputer — UNM Health ransomware attack disrupts patient care, surgeries (opens in a new tab) (27 October 2026)
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)