590/69 Thursday, October 29, 2026
The University of New Mexico Health Sciences Center (UNM HSC) in the United States disclosed a cyberattack that caused disruptions to several systems, affecting medical services and academic operations. On October 26, 2026, UNM Health, the university’s healthcare provider, temporarily limited new patient admissions, diverted ambulances to nearby hospitals, and suspended outpatient surgeries and some scheduled appointments. Classes across all four Health Sciences schools were also canceled, while personnel without essential duties were instructed to temporarily stop working.
Although UNM Health has not officially disclosed the type of attack, BleepingComputer reported that a ransomware group known as Byod claimed responsibility through its data leak site. The group alleged that it had compromised approximately 36,000 systems across the university and hospital network, including the Active Directory forest, Group Policy infrastructure, Microsoft Entra tenant, and two Oracle databases. Byod also claimed to have accessed personal information belonging to students and employees, including Social Security Numbers (SSNs), HR data, payroll information, Banner student records, internal emails, and research data, as well as patient appointment information, health data, and Cerner Electronic Health Records (EHRs). The group initially used the allegedly stolen data to pressure the university into negotiations, but later said it would provide a decryption key free of charge and offered compensation of up to USD 2,500 to each affected patient. However, the group also stated that it would retain the stolen data. Byod’s claims regarding the scope of system access and data theft have not been confirmed by UNM Health.
As of October 27, 2026, UNM Health Sciences Center confirmed that all critical electronic systems had returned to normal operation. The hospital resumed full services, ambulances were again able to transport patients normally, and clinics restarted scheduled appointments and medical procedures. UNM Health stated that the rapid restoration was achieved through cooperation between its IT security team and external specialists working to investigate and secure the network. Preliminary findings indicated that the incident affected some end-user devices, but there was no evidence that attackers gained access to the organization’s core systems or critical servers, differing from the claims made by the Byod group.