Cyberattack on UNM Health diverts ambulances as Byod gang claims breach

A cyberattack on the University of New Mexico (UNM) Health Sciences Center on Monday, October 26, 2026 forced the health system to divert ambulances, limit new admissions and suspend outpatient surgeries and appointments, according to The Record and BleepingComputer. A recently emerged ransomware group called Byod has claimed the attack and says it stole large volumes of patient, student and employee data, claims that have not been independently verified.

What happened

According to The Record, ambulances were diverted for about two hours to other health systems in Albuquerque and Santa Fe, and outpatient surgeries and appointments were suspended for the rest of Monday. Employees received a phone alert instructing them to turn off and unplug desktop computers and disconnect mobile devices from hospital Wi-Fi. A spokesperson said the threat affected the entire Health Sciences Center, which includes an academic campus and research facilities in addition to the hospitals.

The health system's IT team contained the issue and notified federal law enforcement, the spokesperson told The Record, adding that the organization is limited in what it can share because of the active investigation. The spokesperson did not answer questions about whether the incident involved ransomware.

BleepingComputer reported that UNM Hospital and Sandoval Regional Medical Center stayed open, and that UNM Health Sciences later said critical electronic systems were back online, ambulance traffic had returned to normal and clinics had resumed appointments. Classes at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health were cancelled on October 27, and nonessential employees were asked to stay home. UNM said the event did not penetrate core systems or servers, but that some end-user devices were affected.

Byod's claims

According to BleepingComputer, Byod says it compromised 36,000 systems across UNM's main campus and hospital environments, including Active Directory, the Microsoft Entra tenant and two Oracle databases. The group claims access to Social Security numbers, HR and payroll data, student records, internal emails, research data and patient information. Byod later said it would provide free decryption keys to healthcare facilities but would keep the stolen data. The Record described Byod as a group that emerged last month with only a handful of named victims. UNM had not responded to questions about the data theft claims at the time of reporting.

Who is affected

The health system includes the state's only burn unit, a Level 1 trauma center and a children's hospital, according to The Record. Patients whose appointments or procedures were cancelled on Monday will be rescheduled.

What to do

UNM advised patients, staff and students to watch for unsolicited communications and phishing attempts that may exploit the incident. Healthcare organizations should make sure offline procedures for diversion and clinical operations are tested, and that endpoint isolation can be carried out quickly, as UNM's staff instructions illustrate.