Summary
The University of New Mexico Health Sciences Center (HSC) says it has restored the systems used by its healthcare facilities after a cyberattack on October 26, 2026. UNM Health runs the state's only Level 1 trauma center. The attack forced ambulance diversions, canceled appointments and suspended classes at its health-related schools.
Timeline
| Date | Event |
|---|---|
| Oct 26 | IT security teams begin containment around 11 a.m.; ambulances diverted to Albuquerque and Santa Fe systems for about two hours; outpatient surgeries and appointments suspended; medical-school students asked to leave campus |
| Oct 27 | Classes canceled for a second day; hospitals reported fully open, ambulance traffic normal, clinics resuming scheduled care |
| Oct 28 | HSC reports all facilities fully functional |
HSC says it did not pay a ransom.
The Attackers
A newly seen ransomware group calling itself BYOD has claimed the attack. The group posted apologies and said it was offering decryption keys for free because it did not know the affected devices were used in patient care. It nonetheless threatened to keep stolen patient and employee data, offering to delete an individual's information for a $2,500 payment.
UNM has not confirmed any data theft and says the incident is under criminal investigation. HSC has warned the public not to engage with groups claiming responsibility, and asks anyone contacted by the hackers to keep the message and report it to the FBI's Internet Crime Complaint Center (IC3).
Why It Matters
- Hospital attacks create direct patient-safety risk, as the ambulance diversion shows.
- Claims of "free decryptors" do not remove the extortion risk: the data-leak threat is the leverage that remains.
- Small payments demanded from individuals are a growing tactic that shifts pressure onto patients and staff.
Recommendations
- Do not contact or pay extortion actors; preserve their messages and report to IC3.
- Treat unconfirmed claims as potential exposure and monitor for notification updates from UNM Health.
- Healthcare defenders: rehearse downtime procedures, verify segmented and offline backups, and prioritize rapid isolation capability for clinical networks.
- Watch for phishing that references the incident or offers "data removal" services.