The University of New Mexico Health Sciences Center reported a cyberattack resulting in system disruptions, which impacted both patient care and academic functions.
On Monday, UNM Health, the university’s healthcare provider, began limiting new patient admissions, rerouting ambulances to neighboring facilities, and pausing outpatient surgeries and appointments.
As of Tuesday, October 27, UNM stated that UNM Hospital and Sandoval Regional Medical Center remain operational, and all clinics will restart scheduled procedures and appointments. Emergency situations require individuals to contact 911. Furthermore, classes across its four health sciences schools have been canceled today, and nonessential HSC personnel were told to remain at home.
UNM Health serves as a major statewide provider of specialist care, handling over 1 million patient visits each year. Its primary UNM Hospital in Albuquerque operates New Mexico’s sole Level I trauma center, treating the most severely injured patients.
While the specific nature of the cyberattack was not disclosed by UNM, BleepingComputer reported that a new ransomware collective named Byod claimed responsibility. In a statement on their data leak platform, the threat actor asserted it compromised 36,000 systems across the main campus and hospital settings, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases. The threat actor stated, "This is your entire network and infrastructure compromised, the entire university COMPLETELY."
Byod claimed access to personal data belonging to employees and students. To compel payment, the Byod ransomware indicated it would publish the breach details after the university began communication, likely for ransom negotiation. BleepingComputer has requested comment from UNM Health Sciences regarding these data theft claims, but no reply has been received.
In a subsequent post today, Byod ransomware offered free decryption keys for locked systems at healthcare facilities. Additionally, the threat actor promised to compensate up to $2,500 for each patient affected by the attack. The cybercriminals asserted, "We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data," yet they also confirmed they would retain all the stolen data.
Byod is a recently established ransomware group, currently listing six victims on its data leak site, and has already leaked data from three of those entities. The group claims on its FAQ page that it performs "pentesting" to hold data controllers accountable for breaches, asserting that no target is exempt, though selection follows an initial assessment.
UNM Health Sciences announced today that all its essential electronic systems are back online and all UNM Health hospitals are fully operational. Ambulance traffic is now normal, and all clinics have resumed appointments and procedures. The university attributed the rapid recovery to IT security teams collaborating "with external partners to secure the network," noting, "Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers."
This incident highlights how initial access, even when managed, can expose vulnerabilities in platform security, as the Blue Report 2026 indicates that prevention scores often mask risks once attackers utilize valid credentials.
