UNM Health warns patients not to engage with anyone claiming responsibility for cyberattack

UNM Health's warning

UNM Health said in a 31 October 2026 social media post that patients should not respond to or engage with anyone claiming responsibility for the cyberattack. The notice, reported by Yahoo, warned that those responsible may attempt additional scams, including false offers of payments or compensation, and told patients not to click links, open attachments, download files or provide personal or financial information. UNM has not confirmed whether patient records were taken.

Byod, which BleepingComputer described as a new ransomware gang, said in a 27 October 2026 post that it would provide free keys to decrypt locked systems at healthcare facilities. The offer does not match UNM's account: the university has not described the incident as ransomware, and it says the event affected some end-user devices but did not penetrate core systems or servers. UNM's account does not say its systems were encrypted.

"To any patient that was affected, please provide us proof, and we will pay you up to $2,500 each for the inconvenience," the group wrote. "We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data."

The group also said it would keep the stolen data. BleepingComputer reported that Byod lists six victims on its data leak site and says it has published data from three.

What happened to UNM's systems

The operational disruption became public on Monday 26 October 2026, when UNM Health disclosed a cyberattack and began limiting new patient admissions, diverting ambulances to nearby hospitals and suspending outpatient surgeries and appointments, BleepingComputer reported. Classes at its four health sciences schools were canceled, and nonessential Health Sciences Center employees were told to stay home. UNM Hospital and Sandoval Regional Medical Center stayed open, and the organization told people with emergencies to call 911.

In a 27 October 2026 update, a day after the disruption became public, UNM said all critical electronic systems were back online and all hospitals were fully open. Ambulance traffic was normal and clinics had resumed scheduled appointments and procedures. UNM said the quick recovery was possible because IT security teams worked with external partners to secure the network. The university said an assessment found the event affected some end-user devices but did not penetrate core systems or servers.

Yahoo reported that the compromise hit the wider UNM Health Sciences Center, not just the hospital, affecting research activities and clinical operations as well as classes. BleepingComputer reported that UNM Health handles more than 1 million patient visits a year and that its Albuquerque hospital houses New Mexico's only Level I trauma center.

Byod's claims and UNM's response

BleepingComputer reported that Byod claimed the attack and said it compromised 36,000 systems across UNM's main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant and two Oracle databases. The group claimed access to student and employee data including Social Security numbers, HR, payroll and Banner student records, internal emails, research data, hospital appointment data, patient information and Cerner EHR rosters.

"This is your entire network and infrastructure compromised, the entire university COMPLETELY," the threat actor said.

BleepingComputer said it contacted UNM Health Sciences for comment and received no response. The 36,000 figure is Byod's claim and has not been verified by the university. Byod said it would take down its breach post after the university began communicating with it; BleepingComputer reported that was likely part of ransom negotiations.

On its FAQ page, Byod describes its activity as "pentesting" meant to expose vulnerabilities and hold data controllers accountable.