# UNM Health cyberattack diverts ambulances and closes clinics; BYOD ransomware group claims data theft · pwn.watch > The University of New Mexico Health Sciences Center, which includes the UNM Health system and the state's only Level 1 trauma center, was hit by a cybersecurity event on Oct 26 2026. Ambulances were diverted to other hospitals, outpatient surgeries and appointments at its 30+ clinics were cancelled, and Health Sciences classes were called off. Employees reported a message played on their computers claiming student, employee and patient data had been stolen, and a new ransomware group, BYOD, listed the University of New Mexico on its leak site claiming 36,000 machines and SSNs. UNM has not confirmed the claims; systems began coming back in phases that afternoon and the FBI is assisting. Page: https://pwn.watch/i/unm-health-cyberattack-byod-ransomware-oct-2026 · generated 2026-10-27T04:53:51.928Z ## Status - Severity: high · status: live · patch: no-fix-needed - Product: University of New Mexico Health Sciences Center / UNM Health IT systems - Started: 2026-10-26 - Affected: UNM Health Sciences Center systems (UNM Hospital, UNM Medical Group clinics, Sandoval Regional Medical Center) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/unm-health-cyberattack-byod-ransomware-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/unm-health-cyberattack-byod-ransomware-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/unm-health-cyberattack-byod-ransomware-oct-2026.json - This file: https://pwn.watch/i/unm-health-cyberattack-byod-ransomware-oct-2026/llms.txt ## Updates (newest first) - 2026-10-26: UNM Health reports a cybersecurity issue: all ambulance traffic diverted, all clinic appointments cancelled, non-essential staff and Health Sciences students sent home. (https://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hsc) - 2026-10-26: Employees report a message broadcast on their computers claiming theft of student and employee data, SSNs and emails; KOB obtains a recording. (https://www.kob.com/news/top-news/apparent-computer-hacking-attack-hits-unm-hospital/) - 2026-10-26: New ransomware group BYOD lists the University of New Mexico on its leak site, claiming 36,000 machines, both AD forests, Oracle HR/payroll and student records. Unverified. (https://ransomware.live/id/VW5pdmVyc2l0eSBvZiBOZXcgTWV4aWNvQEJZT0Q) - 2026-10-26: UNM Health resumes operations in phases from 2:30 p.m. local time; Health Sciences academic and research units stay closed Oct 27. The FBI is assisting. (https://www.securityweek.com/cybersecurity-issue-forces-a-major-new-mexico-hospital-to-divert-patients-and-close-clinics/) ## Fix brief # Security brief: UNM Health cyberattack diverts ambulances and closes clinics; BYOD ransomware group claims data theft Source: https://pwn.watch/i/unm-health-cyberattack-byod-ransomware-oct-2026 · status: live · severity: high · updated Oct 27, 2026, 03:27 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is The University of New Mexico Health Sciences Center, which includes the UNM Health system and the state's only Level 1 trauma center, was hit by a cybersecurity event on Oct 26 2026. Ambulances were diverted to other hospitals, outpatient surgeries and appointments at its 30+ clinics were cancelled, and Health Sciences classes were called off. Employees reported a message played on their computers claiming student, employee and patient data had been stolen, and a new ransomware group, BYOD, listed the University of New Mexico on its leak site claiming 36,000 machines and SSNs. UNM has not confirmed the claims; systems began coming back in phases that afternoon and the FBI is assisting. Severity detail: Hospital operations disrupted (ambulance diversion at the state's only Level 1 trauma center); data theft claimed by attackers but not confirmed by UNM - Product: University of New Mexico Health Sciences Center / UNM Health IT systems ## Affected versions - UNM Health Sciences Center systems (UNM Hospital, UNM Medical Group clinics, Sandoval Regional Medical Center) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Latest updates - Oct 26, 2026: UNM Health reports a cybersecurity issue: all ambulance traffic diverted, all clinic appointments cancelled, non-essential staff and Health Sciences students sent home. - Oct 26, 2026: Employees report a message broadcast on their computers claiming theft of student and employee data, SSNs and emails; KOB obtains a recording. - Oct 26, 2026: New ransomware group BYOD lists the University of New Mexico on its leak site, claiming 36,000 machines, both AD forests, Oracle HR/payroll and student records. Unverified. - Oct 26, 2026: UNM Health resumes operations in phases from 2:30 p.m. local time; Health Sciences academic and research units stay closed Oct 27. The FBI is assisting. ## Advisories - [Update on Cybersecurity Event at UNM Health Sciences Center](https://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hsc) (UNM HSC Newsroom) - [Cybersecurity Issue Affecting UNM Health Sciences Center Services](https://italerts.unm.edu/) (UNM Information Technologies) ## Write-ups & news - [Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics](https://www.securityweek.com/cybersecurity-issue-forces-a-major-new-mexico-hospital-to-divert-patients-and-close-clinics/) - [UNM Health cybersecurity threat: Ambulances diverted, clinics closed, students sent home](https://www.kob.com/news/top-news/apparent-computer-hacking-attack-hits-unm-hospital/) - [Ransomware.live victim entry: University of New Mexico (BYOD)](https://ransomware.live/id/VW5pdmVyc2l0eSBvZiBOZXcgTWV4aWNvQEJZT0Q) ## Caveats BYOD's claims (36,000 machines, SSNs, EHR rosters) are unverified; UNM says it can't share more during the law enforcement investigation. Update when UNM confirms data access or scope. --- Machine-readable: https://pwn.watch/i/unm-health-cyberattack-byod-ransomware-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.