The University of New Mexico Health Sciences Center has disclosed a cybersecurity incident that caused a system outage, temporarily disrupted patient care and affected academic activities. UNM Health limited new admissions, diverted ambulances and suspended some outpatient surgeries and appointments on Monday, but said on Tuesday, October 27, that its hospitals and clinics had resumed normal operations. A ransomware group called Byod has claimed responsibility, although UNM has not confirmed the type of attack or the group’s allegations about stolen data.
UNM Health, the university’s health care provider, temporarily limited admissions for new patients, diverted ambulances to nearby hospitals and began suspending outpatient surgeries and appointments on Monday.
In an update, UNM said UNM Hospital and Sandoval Regional Medical Center remained open and that all clinics would resume scheduled appointments and procedures on Tuesday, October 27. Medical authorities advised people facing emergencies to call 911.
Classes at four health sciences schools were canceled on Tuesday, while non-essential Health Sciences Center employees were told to stay home.
UNM Health is a statewide provider that delivers specialized treatment to more than 1 million patients each year. UNM Hospital in Albuquerque houses New Mexico’s only Level I trauma center, which treats the most seriously injured patients.
Byod ransomware group claims responsibility
UNM has not disclosed what type of cyberattack it suffered. However, BleepingComputer reported that a new ransomware group called Byod claims to have carried out the attack.
In a post on a data-breach site, the attackers claimed they had compromised 36,000 systems across UNM’s main campus and hospital environments. The alleged access includes Active Directory forests, Group Policy infrastructure, entire Microsoft Entra tenants and two Oracle databases.
“This is a complete compromise of your entire network and infrastructure, your entire university,” the attacker said.
The group also claimed to have accessed personal and institutional data belonging to students and employees, including:
- Social Security numbers (SSNs)
- Human resources, payroll and Banner student records
- Internal email
- Research data
- Hospital reservation data
- Patient information
- The Cerner EHR directory
Byod ransomware said it would remove the posts after the university initiated communications, possibly as part of an attempt to negotiate a ransom or force payment.
BleepingComputer said it contacted UNM Health Sciences for comment on the allegations of data theft but had not received a response.
In a new post on Tuesday, Byod ransomware said it would provide free decryption keys for locked systems at health care facilities.
The attackers also promised to pay up to $2,500 for each patient affected by the cyberattack.
“We have morals, we have hearts, and we are not bad guys, but we will continue to hold companies accountable for poor security that led to the breach of customer data,” the cybercriminals said.
At the same time, the attacker stated that all stolen data would be retained.
Byod ransomware group’s claims
Byod is a new ransomware group with six victims currently listed on the data-breach site. Data allegedly stolen in three of those cases has already been leaked.
On its FAQ page, the group claims to conduct “penetration tests” to expose vulnerabilities and hold data controllers accountable for breaches.
Byod says it has no off-limits targets, although it claims victims are selected after an initial assessment identifies targets of interest. The group says it focuses on “people at the top who see consumers and customers as a number and another dollar in their pocket.”
UNM says critical systems are back online
In an statement issued Tuesday, UNM Health Sciences said all critical electronic systems were back online and that all UNM Health hospitals were fully open. Ambulance traffic was operating normally, and clinics had resumed scheduled appointments and procedures.
The university said its IT security team “worked with external partners to secure the network,” enabling the quick recovery.
“Their assessment found that this event impacted some end-user devices, but did not penetrate core systems or servers,” the UNM Health Sciences Center said.
Patients treated at UNM Hospital, along with staff and students who work and study there, were encouraged to remain vigilant for unsolicited communications and phishing attacks.
The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, defenses can drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com