The University-operated hospital had to divert ambulances following a cyberattack.

 

What happened

On October 26th, 2026, University of New Mexico (UNM) Health System ambulances had to be diverted because the hospital’s network systems had to be temporarily shut down, according to The Record. The ambulances instead had to travel to systems in Albuquerque and Santa Fe. For the hospital itself, all outpatient surgeries and appointments for the day had to be rescheduled. The event impacted patient care alongside the university’s health schools.

Uniquely, the ransomware group allegedly responsible, BYOD, claimed they did not know the attack would directly impact patient care and offered decryption keys for the hospital only.

 

Going deeper

According to a local news report, the incident impacted “dozens” of clinics, although the exact number of victims is not yet known. Those who were affected by the breach could have been directly impacted by being unable to receive care, or indirectly impacted if their data was accessed or stolen.

The same news report shared that the incident emerged rapidly. Employees were issued an alert mid-day on Monday, instructing everyone to turn off and unplug their desktops and disconnect from hospital WiFi on mobile devices while UNM’s security team went to work identifying and isolating the attack.

 

In the know

The breach was claimed by threat group BYOD, which alleged to have compromised 36,000 machines on the university’s campus and in their hospital. BYOD claimed to have data from students, patients, and employees ranging from internal emails to Electronic Health Records.

BYOD is a new group and, according to ransomware tracking organization Ransomware Live, they claimed their first victim on September 29th. Since then, they’ve claimed a total of 10 victims, showing rapid growth. They have attacked organizations in the United States, Singapore, and Malaysia, but little else is known. They have not yet been linked to a country and little else is known about them.

 

What was said

A spokesperson from the UNM said early Monday, “The cybersecurity threat is affecting the entire University of New Mexico Health Sciences Center.” The health system is part of the larger Sciences Center, which includes an academic campus and medical research facilities.

As systems came back online throughout Monday, the spokesperson updated their statement to share that appointments would resume the following day, October 27th, but classes at several of the University’s schools were canceled until October 28th.

The spokesperson shared, “We recognize this event may have impacted patients, employees and students, and we appreciate their patience as our teams respond…Because this remains an active law enforcement investigation, we are limited in what we can share at this time.”

In a statement from BYOD apologizing for causing potential harm to patients and offering decryption tools for the hospital, the group said, “We are sorry once again. We have morals and we have a heart, we are not villains.”

 

The big picture

For UNM patients, the attack can be deadly; according to a local news source, the hospital is New Mexico’s only “Level I Trauma Center,” meaning it is certified to handle the most seriously injured patients. The nearest other Trauma Center of the same level is 400 miles away, and patients are regularly flown into UNM for the care they need. While other hospitals may be able to provide life-saving care in desperate times, they are not equipped to do so in the same way UNM is. Other University Hospitals have also faced devastating attacks recently; just one week prior, the University Hospitals in Cleveland, Ohio had to operate multiple days without critical systems because of a cyber attack.

 

FAQs

Were any patients harmed by the incident?

Currently, there is nothing to suggest that patients were unable to receive care, but much of it was likely delayed. Even if all patients were eventually treated, many had to travel significantly farther and likely underwent significant stress.

 

Was UNM partially responsible for the breach?

UNM may face legal issues in the future if it’s believed they could have prevented the issue. However, healthcare facilities generally do everything they can to prevent attacks. With constantly changing attack strategies and emerging groups, it can be challenging for healthcare organizations to keep up, which is why it’s critical to have outside help from organizations like Paubox.