UNM Health, the University of New Mexico’s health system, cancelled all appointments and outpatient surgeries and briefly diverted ambulances on October 26 after a cyberattack hit its network. A newly emerged group called Byod says it stole data, but UNM disputes the group’s account and has not confirmed that any patient data was taken.
What happened
UNM Health detected the attack on the morning of Monday, October 26, according to the Albuquerque Journal. The HIPAA Journal reports that containment began around 11 a.m. and was described as largely successful. UNM says the incident affected some end-user devices but did not penetrate core systems or servers.
As a precaution, all ambulance traffic was diverted to other hospitals from 12:30 to 2:30 p.m. UNM Hospital is the state’s only level 1 trauma center, according to the HIPAA Journal. All scheduled appointments and outpatient surgeries were cancelled that day, and students and non-essential staff at the Health Sciences Center were sent home. Infosecurity Magazine reports that hospitals reopened by 10:27 p.m. Monday and clinics were due to resume regular appointments on October 27. The Albuquerque Journal says some employees were still being asked not to turn on their computers as of October 28.
The group calling itself Byod claimed responsibility. Per the reports, it says it compromised 36,000 systems and took student, employee and patient data, including payroll records and internal emails. These claims are unverified. UNM spokesperson Chris Ramirez said the information UNM released is “factual and accurate despite what other groups may be claiming.” UNM says it has made no concessions to the attackers, and the FBI is running a forensic analysis as part of a criminal investigation.
The HIPAA Journal also reports that Byod later said it did not know UNM Health ran systems supporting patients in real time, and offered free decryption keys for the hospital sector. Treat that with caution: it is the group’s own statement, and UNM has said the attack did not reach its core systems.
Who is affected
The health system reports more than one million patient visits a year, per Infosecurity Magazine, so the potential pool of patients, students and employees is large. UNM has said it is too early to determine whether patient data was involved. Anyone who received care or worked or studied at UNM Health Sciences Center should watch for official notices.
What to do
UNM officials advised people not to engage with groups claiming responsibility, not to click links or open attachments from unexpected messages, and to report any contact from such a group to the FBI at IC3.gov or 1-800-CALL-FBI. Our analysis of sensible extra steps for those who may be affected:
- Treat any email, text or call about this incident as suspect until you confirm it through UNM’s official website or a phone number you look up yourself.
- Turn on multifactor authentication for patient portal, email and banking accounts, and use unique passwords.
- Consider a credit freeze if UNM later confirms that Social Security numbers were exposed. Nothing so far confirms that.
- Reschedule cancelled care through UNM’s official channels, not through links in messages.
What we still do not know
- Whether any patient, student or employee data was actually stolen. UNM has not confirmed it.
- Whether this was ransomware in the strict sense, since UNM has not described the attack or any ransom demand.
- How the attackers got in, and how many devices were affected.
- Whether all systems are fully restored.
Sources: HIPAA Journal (Oct. 28, 2026); Albuquerque Journal (Oct. 28, 2026); Infosecurity Magazine (Oct. 27, 2026).
Leave a Reply