UNM Health cyberattack: hospitals recover; BYOD group offers keys, keeps data

A cyberattack on the University of New Mexico's health system in the United States forced its hospitals to divert ambulances, cancel surgeries and clinic appointments, and call off classes at its medical, nursing and pharmacy schools from Monday, October 26, 2026. By Wednesday, October 28, the university said classes and research had resumed and clinical services were fully working again. A ransomware group calling itself BYOD has claimed the attack, apologised, offered to free the hospital's files and to pay patients up to $2,500 each, while saying it will keep the data it says it took. None of the group's claims have been verified, and the university has warned the public not to deal with anyone claiming responsibility.

UNM Hospital runs New Mexico's only level 1 trauma centre, the highest grade of emergency care for the most seriously injured patients. When such a hospital has to divert ambulances, injured people may have to travel further for treatment. That is why attacks on hospitals are treated as some of the most serious cyber incidents: they can delay care, not only expose data.

Ransomware is malicious software that scrambles, or encrypts, an organisation's files so that they cannot be opened, after which the attackers demand money for a "decryption key" to unlock them. Many groups now also copy data before encrypting it and threaten to publish it, which is called double extortion. BYOD's offer fits that pattern. According to reports of its statement, it said it would give the hospital its keys for free and pay patients for the inconvenience, but that it is "still going to keep the data". That would leave any personal records it took, which it says include Social Security numbers, payroll records and student files, in criminal hands.

Such statements from criminals cannot be taken at face value: the offer of payments to patients has not been shown to be real, and it is not clear whether the group's keys played any part in UNM's recovery. Reports say BYOD removed its post about the breach after the university began communicating with it, which may point to talks. The university has not commented on any contact or ransom.

The case also shows how a single incident spreads across a university that runs both hospitals and teaching. The same networks serve patients, students and researchers, so one attack shut down operating rooms and lecture halls at the same time.

Short-term: Patients whose appointments or surgeries were cancelled need to rebook. Students lost two days of classes. The main open question is data: if BYOD's claims are true, patients, staff and students could face phishing (fake messages that try to trick people into giving passwords or money) and identity fraud.

Long-term: The investigation will decide whether personal data was taken and whether the university must formally notify those affected. The case adds to pressure on hospitals to separate clinical systems from office networks and keep offline backups, so that they can recover without paying attackers.

Who is affected: Patients of UNM Health, including people who needed emergency care during the diversion; students and staff of the UNM Health Sciences Center; and hospitals elsewhere that face the same threat. For users, the standard advice applies: be wary of calls, texts or emails claiming to be from the hospital, do not reply to anyone claiming to be the attackers, and watch bank and insurance statements.

Questions and Answers