UNM Health cyberattack diverts ambulances and closes clinics; BYOD ransomware group claims data theft
University of New Mexico Health Sciences Center / UNM Health IT systems
The University of New Mexico Health Sciences Center, which includes the UNM Health system and the state's only Level 1 trauma center, was hit by a cybersecurity event on Oct 26 2026. Ambulances were diverted to other hospitals, outpatient surgeries and appointments at its 30+ clinics were cancelled, and Health Sciences classes were called off. Employees reported a message played on their computers claiming student, employee and patient data had been stolen, and a new ransomware group, BYOD, listed the University of New Mexico on its leak site claiming 36,000 machines and SSNs. UNM has not confirmed the claims; systems began coming back in phases that afternoon and the FBI is assisting.
Why this severity: Hospital operations disrupted (ambulance diversion at the state's only Level 1 trauma center); data theft claimed by attackers but not confirmed by UNM
- Started
- Oct 26, 2026
Affected
- UNM Health Sciences Center systems (UNM Hospital, UNM Medical Group clinics, Sandoval Regional Medical Center)
Fixed in
No fixed release yet
Timeline4
UNM Health reports a cybersecurity issue: all ambulance traffic diverted, all clinic appointments cancelled, non-essential staff and Health Sciences students sent home.
Employees report a message broadcast on their computers claiming theft of student and employee data, SSNs and emails; KOB obtains a recording.
New ransomware group BYOD lists the University of New Mexico on its leak site, claiming 36,000 machines, both AD forests, Oracle HR/payroll and student records. Unverified.
UNM Health resumes operations in phases from 2:30 p.m. local time; Health Sciences academic and research units stay closed Oct 27. The FBI is assisting.
Advisories2
News & write-ups3
- Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close ClinicsSecurityWeek (Associated Press) · Oct 26, 2026
- UNM Health cybersecurity threat: Ambulances diverted, clinics closed, students sent homeKOB 4
- Ransomware.live victim entry: University of New Mexico (BYOD)Ransomware.live
Notes & caveats
BYOD's claims (36,000 machines, SSNs, EHR rosters) are unverified; UNM says it can't share more during the law enforcement investigation. Update when UNM confirms data access or scope.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
