UNM Health restored systems after cyberattack

Update November 2, 2026: UNM later said it had restored the systems at its health facilities and had not paid a ransom after the incident. Specialized media also added context on the attribution claimed by BYOD, which remains unconfirmed by the university, and on an HHS-OCR regulatory precedent that is not tied to this case.

UNM Health restored the systems at its health facilities after the cyber incident that forced ambulances to be diverted, procedures and outpatient appointments to be canceled, and academic activities to be suspended. The university also reiterated that it did not pay a ransom, and said its technical review showed the event affected some endpoint devices but did not reach core systems or servers.

What happened to UNM Health's systems?

UNM Health began bringing its systems back online in phases starting at 2:30 p.m. on October 26, and said clinics would resume scheduled appointments and procedures on October 27. Later, the University of New Mexico said all of its hospitals had reopened, scheduled appointments had resumed, and ambulance traffic was operating normally.

The institution also said classes in some units of the Health Sciences Center were canceled through Tuesday. At the same time, UNM said it had made no concessions to the attackers after the incident.

What is known about the attribution?

Attribution to the BYOD group remains unconfirmed by the university. According to unverified sources cited by INkl, the group claimed to have compromised 36,000 systems across the main campus and UNM hospital environments, and said it obtained data from patients, students and employees.

The university did not validate that version. Infosecurity Magazine reported, based on an identification attributed to cybersecurity intelligence firm VenariX, that a BYOD post claimed responsibility for the incident, but UNM did not confirm that attribution.

It was also not publicly clear whether patient data was affected or whether the incident involved ransomware, according to Becker's Hospital Review. The Register noted that BYOD's claim does not by itself show the group caused the incident or that a ransomware payload was deployed, while Help Net Security said it was unclear whether BYOD encrypted data on UNM's systems.

Fortra added that BYOD claimed to have compromised tens of thousands of computers and obtained personal data, including Social Security numbers, from students and employees, but those claims were not independently verified. The same post also described the group as an extortion operation that publishes alleged intrusions on a Tor leak site.

What other precedent was added as context?

The HHS-OCR $800,000 settlement with Lehigh Valley Health Network was added as regulatory context, but it relates to a 2023 ransomware investigation and not to any ransom payment in UNM's case. According to the Department of Health and Human Services, OCR tied that investigation to suspicious activity detected on February 4, 2023, and later determined to be ransomware.

That settlement also requires a three-year corrective action plan. BankInfoSecurity cited it as part of broader context on attacks against hospitals and legal consequences.

The University of New Mexico detected a cybersecurity threat at its Health Sciences Center around 11:00 a.m. on October 26. The initial assessment found the incident affected some endpoint devices, but did not penetrate core systems or servers. Even so, it caused temporary ambulance diversions, canceled clinic appointments and the suspension of outpatient surgeries.