UNM Health Restores Systems After Cyberattack Disrupted Patient Care

Summary

UNM Health says a cyberattack disrupted patient care and caused system outages, but critical systems are back online. Ransomware group Byod claimed access to systems and personal data; UNM's assessment said core systems and servers were not penetrated.

Key points

UNM Health temporarily limited new admissions, diverted ambulances and suspended outpatient surgeries and appointments during the incident.
UNM said hospitals remained open and that clinics resumed scheduled appointments and procedures.
UNM's assessment said some end-user devices were affected, but core systems and servers were not penetrated; the organization credited external partners in securing the network.
Byod claimed it compromised 36,000 systems and accessed student, employee and patient information, including Social Security numbers and medical records. These claims were not independently confirmed in the article.
Byod said it would keep the allegedly stolen data; UNM had not responded to BleepingComputer's request for comment on the data-theft allegations.
UNM advised patients, staff and students to watch for unsolicited communications and phishing.

Article Details

Victim Organization: UNM Health / University of New Mexico Health Sciences Center
Incident Type: Cyberattack; Byod claimed it was a ransomware attack.
Incident Date: 2026-10-26
Disclosure Date: 2026-10-27
Data Types Exposed: Social Security numbers (claimed by Byod; unverified)
HR and payroll records (claimed by Byod; unverified)
Student records (claimed by Byod; unverified)
Internal emails (claimed by Byod; unverified)
Research data (claimed by Byod; unverified)
Hospital appointment data (claimed by Byod; unverified)
Patient information, including Cerner EHR rosters (claimed by Byod; unverified)
Operational Impact: UNM Health temporarily limited new patient admissions, diverted ambulances, suspended outpatient surgeries and appointments, and canceled health sciences classes. UNM later said critical electronic systems were back online, hospitals were fully open, ambulance traffic was normal, and clinics had resumed appointments and procedures. UNM said its assessment found some end-user devices affected but no penetration of core systems or servers. Byod claimed it compromised 36,000 systems; that claim was not verified.
Ransom Or Extortion: Byod said it would remove its breach-site post after UNM initiated communication, reportedly to negotiate a ransom, and said it would retain the allegedly stolen data. The group also offered free decryption keys for affected healthcare facilities and promised up to $2,500 per affected patient.
Claim Status: claimed

Threat Actors

BYODByod claimed responsibility for the attack on UNM Health and alleged it compromised systems and stole data; these claims were not confirmed in the article.

Products

BannerHR, payroll, and Banner student records Cerner EHRCerner EHR rosters Group Policy36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases.Microsoft Active Directorysaid it had compromised 36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases.Microsoft Entrahospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases.

Industries

HealthcareOn Monday, UNM Health, the university’s healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments.