# UNM Health Cyberattack Forces Ambulance Diversions and Canceled Surgeries

- URL: https://usa-24.com/unm-health-cyberattack-ambulance-diversions/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-29T21:37:16.444Z
- Updated: 2026-10-29T21:37:16.453Z
- Topics: Ransomware, Healthcare Cybersecurity, Data Breach, Hospital Security, New Mexico

> A ransomware group called BYOD claims it stole patient, student and employee data from the University of New Mexico Health Sciences Center. UNM says critical systems are back and has not confirmed the theft.

## Key takeaways

- The attack was detected around 11 a.m. MT on Monday, October 26, and UNM Health diverted ambulances to other hospitals from 12:30 to 2:30 p.m.
- UNM said critical systems were restored at 2:02 p.m. Tuesday, October 27, about 27 hours after containment began.
- UNM says the attack affected some end-user devices and did not penetrate core systems or servers.
- The BYOD group claims it compromised about 36,000 systems and stole Social Security numbers, but UNM has not confirmed any data theft.
- UNM has warned the public not to engage with groups claiming responsibility, and the FBI said it is assisting the investigation.

Ambulances stopped bringing new patients to UNM Hospital on Monday afternoon after a cyberattack hit the University of New Mexico Health Sciences Center. The state’s only Level I trauma center limited intake for two hours, canceled outpatient surgeries and appointments for the rest of the day, and needed about 27 hours to restore critical systems.

A ransomware group calling itself BYOD says it stole patient, student and employee data. UNM has not confirmed that claim, has not named the type of attack, and says the criminal investigation limits what it can disclose. The story is still moving, so the facts below separate what UNM has said from what the group alleges.

## UNM Health cyberattack timeline, hour by hour

UNM’s IT teams identified a threat around 11 a.m. MT on Monday, October 26, and began containment. [Asimily](https://asimily.com/blog/unm-health-cyberattack/), which summarized UNM’s public statements, lays out the sequence below.

| Time | What happened |
|---|---|
| Mon., Oct. 26, about 11 a.m. MT | UNM IT teams identify a threat and begin containment |
| Mon., 12:30 to 2:30 p.m. | Ambulances are diverted to other hospitals and new patient intake is limited |
| Mon., afternoon | Outpatient surgeries and appointments are canceled for the rest of the day |
| Mon., from 2:30 p.m. | Systems begin returning in phases |
| Tue., Oct. 27 | Classes at four health sciences schools are canceled and nonessential staff stay home |
| Tue., 2:02 p.m. | UNM says critical systems are restored, ambulance traffic is normal and clinics resume scheduled care |

The ambulance diversion was the most visible effect. [HIPAA Journal](https://www.hipaajournal.com/university-new-mexico-health-system-cyberattack/) reported that the health system sent ambulances to other hospitals, with Albuquerque and Santa Fe facilities absorbing the routing. In a trauma system, a two-hour gap in one hospital’s intake matters, because the nearest appropriate facility is not always the one that can take the next patient.

A UNM Health statement, as quoted by [Medical Daily](https://www.medicaldaily.com/unm-health-cyberattack-ambulance-diversion-data-claims-480515), told the public: “Emergencies should be handled by 911, and non-emergencies should be delayed until further notice.” That instruction shows how quickly a network outage can become a public-safety message.

## Which patients, students and staff were affected

UNM Hospital is large. [BankInfoSecurity](https://www.bankinfosecurity.com/cyberattack-disrupts-new-mexicos-only-trauma-center-a-33220) reports that it has 618 beds and sees about 1 million patient visits, 80,000 emergency room patients and about 20,000 urgent care patients a year. Those volumes explain why an afternoon of disruption reached so many people.

UNM said at least 30 clinics were affected. Patients in the Albuquerque and Santa Fe area felt the impact most directly, through canceled appointments and rerouted ambulances. Students were hit too. Classes at four health sciences schools were canceled on Tuesday, and [The Daily Lobo](https://www.dailylobo.com/article/2026/10/cyberattack-forces-closure-of-unm-hsc-and-suspension-of-classes-research-through-tuesday) reported that research was also paused through Tuesday.

Nonessential employees were also told to stay home, so the disruption reached administrative and support staff as well as clinical teams.

## What the BYOD group claims about stolen data

The BYOD group claimed responsibility on its leak site. [Tech-Insider](https://tech-insider.org/unm-health-ransomware-attack-byod-36000-systems-claim-2026/) reports that the group says it compromised about 36,000 systems, including Active Directory forests, Group Policy infrastructure, the Microsoft Entra tenant and two Oracle databases. If that scope is accurate, the attackers reached the systems that control identity, access and records, which is a much larger problem than a set of infected workstations.

The group also says it took Social Security numbers, HR and payroll data, Banner student records, email and research data. [BleepingComputer](https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/) spells the group “Byod,” and it reported the claims without independent confirmation. None of the data theft has been verified.

The group also broadcast a text-to-speech message to hospital workers’ computers, directing administrators to contact it over the Session messaging app. That tactic skips the help desk and goes straight to people who may have authority over payments or system access, which makes internal escalation a priority for any hospital in this position.

According to [Gizmodo](https://gizmodo.com/hacker-group-claims-unm-hospital-cyberattack-then-apologizes-and-offers-patients-2500-2000832169), the group later posted an apology and offered free decryption keys for locked devices, limited to the hospital sector. A Gizmodo headline also reports a $2,500 offer to patients, but that figure is not confirmed in the report’s body text, so treat it as unverified. Whether any key works remains an open question.

## Why the ransomware label and the scope remain disputed

UNM has not used the word ransomware. BleepingComputer and HIPAA Journal describe the incident that way, and BYOD says it locked systems. The label matters less than the scope.

UNM says the attack affected some end-user devices and did not penetrate core systems or servers. The group says it reached identity infrastructure and databases. Both accounts cannot be fully correct, and no independent forensic findings have been published in the reporting so far.

For patients, the gap is practical. If only end-user devices were hit, the immediate risk centers on workstations and the data stored on them. If identity systems and databases were compromised, any record stored there could be at risk, and the investigation would take longer to finish.

USA 24 has seen similar uncertainty in other extortion cases. [Emperador’s breach claim against AB InBev](https://usa-24.com/ab-inbev-data-breach-claim/) followed the same pattern, with a claim the company had not confirmed.

## What UNM patients, students and staff should do now

UNM has not confirmed data theft, so no one should assume their records are gone. The steps below are general recommendations, not instructions from UNM.

- Get updates only from official UNM Health channels, and confirm appointments through a phone number from your own records or the official website.
- Ignore any message from someone claiming to be the hackers, including Session messages and offers of payment or decryption keys.
- Watch for phishing emails, texts and calls that mention the outage, account verification or a breach involving UNM.
- If your Social Security number or financial account data may have been exposed, consider a credit freeze with each of the three major credit bureaus and review bank and card statements every month.
- Do not contact or pay the extortionists. UNM has warned the public not to engage with groups claiming responsibility for the incident.

## A wider 2026 pattern across healthcare and education

The UNM case is part of a broader run of breaches. A weekly roundup from [Kaseya](https://www.kaseya.com/blog/the-week-in-breach-news-10-28-26/) flagged Quest Diagnostics among US medtech providers hit this year, alongside Medtronic, AdaptHealth and iRhythm, which have reported significant patient data exposures. Those incidents differ in cause and actor, but a shared thread is that one compromised account or directory can reach many systems at once.

Education has seen similar exposures. [Frontline Education’s breach](https://usa-24.com/frontline-education-data-breach/) put staff Social Security numbers and student records at risk, the same categories BYOD now claims to hold. [Richmond Public Schools](https://usa-24.com/richmond-public-schools-ransomware-attack/) stayed offline for days after ransom notes appeared, a reminder that operations can stay down for days even when the data question is unresolved.

## What to watch next in the UNM Health investigation

Three questions will shape how serious this becomes. First, whether UNM confirms data theft and, if it does, when it sends notices. The reporting reviewed does not give a timeline. Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach, so patients could hear within about two months of the attack.

Second, whether BYOD publishes verifiable samples of the data it says it holds. Third, whether investigators release attribution or make arrests. The FBI said it was assisting, and law enforcement was notified at the state and federal levels.

Clinical operations are back, and the wait for answers is the new phase. UNM’s own statements and the investigators who can verify what was taken are the sources to trust most. Anything the group posts should count as a claim until someone checks it.

## Frequently asked questions

### Is the UNM Health cyberattack ransomware?

UNM has not used the word ransomware or named the type of attack. BleepingComputer and HIPAA Journal describe the incident as ransomware, and BYOD says it locked systems. UNM says the criminal investigation limits what it can disclose.

### Are UNM Hospital services back to normal?

UNM said by 2:02 p.m. Tuesday, October 27, that critical systems were restored, ambulance traffic had returned to normal and clinics had resumed scheduled care. Outpatient surgeries and appointments were canceled on Monday afternoon, so patients should confirm any visit directly with UNM Health. Classes at four health sciences schools were canceled on Tuesday.

### Was patient data stolen in the UNM Health cyberattack?

UNM has not confirmed any data theft. The BYOD group claims it took Social Security numbers, HR and payroll data, Banner student records, email and research data, but those claims have not been independently verified. Patients, students and employees can take protective steps such as a credit freeze while the investigation continues.

### Should I pay or respond to the BYOD hacker group?

No. UNM warned the public not to engage with groups claiming responsibility for the incident. Paying an extortion group offers no guarantee that data will be deleted or that locked devices will be unlocked.

## Sources

1. [UNM Health ransomware attack disrupts patient care, surgeries](https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/)
2. [UNM Health Cyberattack: Lessons for Hospital Security](https://asimily.com/blog/unm-health-cyberattack/)
3. [University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack](https://www.hipaajournal.com/university-new-mexico-health-system-cyberattack/)
4. [UNM Hospital diverted ambulances for two hours after a cyberattack](https://www.medicaldaily.com/unm-health-cyberattack-ambulance-diversion-data-claims-480515)
5. [Cyberattack Disrupts New Mexico's Only Trauma Center](https://www.bankinfosecurity.com/cyberattack-disrupts-new-mexicos-only-trauma-center-a-33220)
6. [Cyberattack forces closure of UNM HSC and suspension of classes](https://www.dailylobo.com/article/2026/10/cyberattack-forces-closure-of-unm-hsc-and-suspension-of-classes-research-through-tuesday)
7. [UNM Health Ransomware: 36,000 Systems Claimed [2026]](https://tech-insider.org/unm-health-ransomware-attack-byod-36000-systems-claim-2026/)
8. [Hacker Group Claims UNM Hospital Cyberattack, Then Apologizes and Offers Patients $2,500](https://gizmodo.com/hacker-group-claims-unm-hospital-cyberattack-then-apologizes-and-offers-patients-2500-2000832169)
9. [The Week In Breach News: October 28, 2026](https://www.kaseya.com/blog/the-week-in-breach-news-10-28-26/)