The UNM Health ransomware attack, as several outlets now label it, started on Monday, October 26, 2026. University of New Mexico Health Sciences Center security teams spotted a threat, ambulances were diverted, and a group calling itself BYOD says it compromised 36,000 systems across campus and hospital networks. That number comes from the attackers alone.
UNM has not confirmed it. The university calls the event a cybersecurity event, has not publicly named ransomware, and says some end-user devices were affected while core systems and servers were not penetrated. Two days in, the gap between the attacker’s story and the institution’s story is the real news.
This analysis separates what UNM and the press have confirmed from what BYOD merely asserts. It also looks at the identity and health-record systems named in the claim, the regulatory and market backdrop, and what hospital security teams can do this week. For wider context on how extortion crews pick targets, see these 2026 ransomware data trends.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened at UNM Health on October 26
UNM Health Sciences Center security teams identified a cybersecurity threat at about 11 a.m. on Monday, October 26. They began containment, notified state and federal law enforcement, and brought in outside partners. By mid-afternoon, around 2:30 p.m., the health system had started restoring systems in phases.
The operational hit was immediate. Ambulance traffic went elsewhere, clinical appointments were canceled, and Health Sciences campus classes stopped. Nonessential employees and students in several health-profession schools were told to leave campus for the rest of the day. Reporting also described temporary restrictions on new admissions.
| Date and time | Event | Who reported it |
|---|---|---|
| Oct. 26, about 11 a.m. | Threat identified, containment starts, law enforcement notified | UNM Health Sciences Center |
| Oct. 26, about 2:30 p.m. | Phased system restoration begins | UNM Health |
| Oct. 26, 6:08 p.m. and 10:27 p.m. | Further public updates posted | UNM newsroom |
| Oct. 26 to 27 | BYOD lists UNM and claims 36,000 systems | BleepingComputer, RansomLook |
| Oct. 27, 2:02 p.m. | Critical electronic systems reported back online, hospitals open, ambulance traffic normal | UNM Health Sciences Center |
| Oct. 27 | Classes canceled for a second day | The Register |
| Oct. 27 | BYOD offers free decryption keys for hospital-sector devices | BleepingComputer |
| Oct. 28 | Investigation still active, BYOD claims still unverified | Public monitoring |
The timeline matters because it shows a fast containment cycle. A health system that starts phased restoration roughly three and a half hours after detection has working incident-response plans. Whether those plans protected data is a separate question that nobody outside UNM can answer yet.
What UNM Has Actually Confirmed So Far
The official record is short and careful. In the words posted by the university and reported by The Register, the statement reads: “The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026.” That sentence is attributed to the University of New Mexico, and it does not blame ransomware or any named group.
By October 27, UNM Hospital and Sandoval Regional Medical Center were open again. Ambulance traffic had returned to normal, and clinics resumed scheduled appointments and procedures. UNM also said the matter sits under criminal investigation, which limits what officials can disclose.
Two details deserve attention. First, UNM said some end-user devices were affected while core systems and servers were not penetrated. Second, the institution has not publicly confirmed data theft, named an attacker, or said whether its electronic health-record system was touched. Any headline that says UNM was hit by ransomware repeats the attacker’s framing, not UNM’s.
BYOD’s Claims: 36,000 Systems and What Stays Unverified
BYOD told a very different story on its leak-site listing. In its own words, as archived on RansomLook, the BYOD ransomware group wrote: “This is your entire network and infrastructure compromised, the entire university COMPLETELY.” Neither UNM nor any outside party has verified that statement, and the group has offered no public proof that investigators have confirmed.
The numbers BYOD cites
According to BleepingComputer’s monitoring of the group’s post, BYOD claims roughly 36,000 compromised machines across the main campus and hospital environments. The claimed footprint includes both Active Directory forests, the entire Microsoft Entra tenant, two Oracle databases, HR and payroll systems, Banner student records, internal email, research data, and patient-related systems. It also claims Social Security numbers and Cerner EHR rosters.
| Question | BYOD claim | Status as of Oct. 28 |
|---|---|---|
| Was it ransomware? | Yes, systems locked and data held | UNM says cybersecurity event and has not identified ransomware |
| How many systems? | About 36,000 machines | UNM says some end-user devices were affected, core servers were not penetrated |
| Identity infrastructure | Both Active Directory forests and the full Entra tenant | Not confirmed by UNM or independent parties |
| Databases | Two Oracle databases | Not confirmed |
| Personal data | SSNs, HR and payroll, Banner student records, email, research | No independent confirmation of exfiltration |
| Health records | Cerner EHR rosters | No official confirmation that the EHR was breached |
| Patient payments | Up to $2,500 per affected patient | Alleged offer only |
The decryption offer and the $2,500 promise
On October 27, BYOD changed tone. The group wrote that it was “offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time.” It said it would keep the allegedly stolen data, and monitoring of its post also reported an offer of up to $2,500 per affected patient.
Treat that as a claim, not a gift. The same listing says: “We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data.” Patients lost appointments and surgeries regardless of what the group says it intended. Free keys also do nothing for the data it says it kept.
Who Is the BYOD Ransomware Group?
Almost nobody knows yet. Public monitoring describes BYOD as a newly emerged ransomware and extortion group. Its identity, infrastructure, malware, leadership, and operating history are not verified. The UNM listing is the only notable development tied to the name in recent months.
That makes attribution hard and makes the group’s claims hard to weigh. A new crew has every incentive to inflate numbers, because a headline with 36,000 systems draws attention and pressure. A new crew might also be telling the truth. Established groups leave tooling and negotiation habits that analysts can compare, and BYOD has no such trail yet. The Qilin attack on Bathurst RSL shows what a better-known group’s footprint gives defenders: a body of prior behavior to measure a claim against.
The group’s stated motive also stands out. It frames the attack as accountability for weak security, a rationale some crews use to look principled. Hospitals still pay the operational cost, whatever the label. Regulators and prosecutors will judge the conduct by its effects.
The Patient-Care Disruption in Detail
Headlines show how broad the impact was. Infosecurity Magazine titled its story around surgeries canceled and an ambulance diverted. BankInfoSecurity’s headline calls the disrupted system New Mexico’s only trauma center. Duke City Ledger led with the gap between the gang’s claim and UNM’s position, since the university had not confirmed it.
Ambulance diversion is the clearest harm marker in a hospital cyber incident. When a trauma-capable facility stops accepting patients, crews drive longer and neighboring hospitals absorb the load. The recovery report, hospitals fully open by October 27, suggests the diversion lasted roughly a day. That is quick by any standard, though no public data yet shows what delayed care cost patients.
Academic operations took a second hit. Classes were canceled for at least two days, and nonessential staff stayed home. UNM had also scheduled its Sandia Vista Primary Care Clinic, a 16,735-square-foot family-medicine site in Albuquerque’s Southwest Mesa, to open on October 26. Reports do not say whether that opening went ahead as planned.
Why This Hospital Ransomware Attack Matters Beyond New Mexico
Academic medical centers carry a double burden. They run clinical systems that cannot go dark and a university network that must stay open to thousands of students, researchers, and visiting staff. UNM’s own description of the event, covering clinical delivery, students, and nonessential employees, shows how tightly those worlds are bound.
BYOD named research data among its claims. On October 23, a UNM-led team received a $13.5 million NIH award for the PC-BRIDGE project, which runs through September 2031. The two stories are unrelated according to the sources, but they illustrate what sits on a health sciences campus: patient files, payroll, grant-funded science, and student records on connected infrastructure.
Patterns elsewhere reinforce the risk. Our look at data-theft extortion aimed at schools and hospitals shows why campuses that combine both are attractive. A single intrusion can pressure a clinic, a registrar, and a research lab at once.
The Oracle Health and Cerner Question
BYOD specifically mentions Cerner EHR rosters. No official UNM or Oracle statement identifies Cerner as the affected system, the attack path, or the cause. The only link in the public record is the group’s own list, so writing that Cerner was breached would be wrong.
Product naming adds confusion. Oracle’s health pages now use both Oracle Health and Oracle Cerner labels, with Oracle Health as the lead brand. Oracle documentation reportedly describes Oracle Health EHR as formerly Cerner Millennium, and its release index reportedly lists Oracle Health EHR 26.04.01 as the current release. Readers searching for Cerner news should expect to see either name.
One more caution. Oracle’s October 2026 Critical Patch Update reportedly lists Oracle Healthcare Master Person Index versions 5.0.0.0 through 5.0.9.7 among affected products. That is a patient-identity component, not the EHR, and nothing in the sources connects it to UNM. Mentioning it here only reminds IT teams that Oracle’s health stack received October patches worth checking.
Microsoft Entra and Active Directory: The Identity Angle
The most alarming line in BYOD’s list is the claim that both Active Directory forests and the whole Entra tenant fell. If true, an attacker would hold the keys to sign-in for staff, students, and applications. UNM’s statement that core systems and servers were not penetrated points the other way, and nobody outside the investigation can settle it.
Microsoft’s current documentation names Microsoft Entra ID Free, P1, and P2 plans. P1 adds hybrid access, dynamic groups, advanced administration, group self-service, and cloud write-back. P2 adds risk-based identity protection and Privileged Identity Management. Microsoft’s documentation also notes the product’s former name, Azure Active Directory. No Microsoft source links Entra to the UNM incident.
Two Microsoft changes deserve a calendar entry for hospital administrators. Customers using Entra Connect Sync must deploy version 2.6.84.0 or later and configure application-based authentication by April 7, 2027 to keep directory synchronization working. Separately, Conditional Access policies that target “All resources” now evaluate baseline scopes as directory access even when resource exclusions exist, so old exclusions may behave differently than admins expect.
Market and Regulatory Impact: The Week’s Security Backdrop
UNM’s incident did not land in a quiet week. The headline feed on The Record shows a steady run of enforcement and deal news around it. The table lists headlines as that outlet published them, not independent verification of the underlying stories.
| Date | Headline as published | Why hospitals should care |
|---|---|---|
| Oct. 27 | Nefilim and Hive ransomware operator given a five-year-plus sentence after guilty plea | Prosecutors are reaching individual operators |
| Oct. 23 | Quest Diagnostics warns of potential data theft after attack on lab service system | Another healthcare data-exposure warning in the same week |
| Oct. 20 | 23andMe successor settles with California for $6 million over cybersecurity failings | State regulators price security lapses in dollars |
| Oct. 19 | Ahold Delhaize confirms malicious actions behind cyber outages affecting grocery brands | Operational outages hit retail as well as care |
| Oct. 16 | Proofpoint lines up $6.3 billion deal for Varonis’ data security | Data-security vendors are consolidating |
The Proofpoint headline is the clearest market signal. A $6.3 billion deal, described as lined up rather than closed, suggests buyers are paying for data-security tooling just as incidents like UNM raise its profile. Compare that with the ransomware surge and the KillSec arrest, where attack volume climbed even as an arrest was made.
No credible public figure exists yet for UNM’s recovery cost, insurance exposure, or lost revenue from canceled surgeries. Any number circulating on social media is a guess. Smaller healthcare providers should also watch leak-site behavior, because leak-site claims like the one against Tower show how a listing can drive pressure before a victim confirms anything.
Historical Context: How Hospital Extortion Keeps Evolving
Ransomware against hospitals began as lock-and-pay schemes. Over the past several years, crews shifted toward stealing data first and encrypting second, which gives them leverage even when backups work. BYOD’s offer to release keys while keeping data fits that model exactly. The decryptor is cheap to give away, and the stolen files are the real product.
Newer crews also experiment with public image. Some claim ethical limits, and some pick niche sectors, like the n0n Group, which threatens maritime firms. BYOD’s mix of apology, free keys, and promised patient payouts is unusual enough that analysts will study it, but it follows the same incentive: get paid or get attention.
Leadership timing adds a human layer. According to UNM’s announcement, Dr. Steve McLaughlin will become CEO of UNM Hospital and vice president of Clinical Affairs on December 6, 2026, succeeding Kate Becker, who announced her retirement earlier this year. The incoming executive will inherit the incident review, the notification decisions, and any regulator questions.
How the Coverage Compares: Four Framings
Outlets framed the story differently, and the differences are useful. BleepingComputer leaned on the leak-site claim and the claimed 36,000 systems, since its analysts monitor the group’s post. Infosecurity Magazine centered patient harm. The Register tracked the second day of canceled classes. The Record emphasized ambulance diversions and the incident’s effect on neighboring hospitals.
None of them independently confirmed BYOD’s scale. That is the key reading rule for the next week: the more specific a number, the more likely it traces back to the attacker’s own listing. When UNM publishes a verified count of affected devices or records, that figure should replace every earlier estimate.
Five Predictions for the Next 30 Days
These are analysis, not reporting. Each follows from the confirmed facts above.
- UNM will keep the label cybersecurity event until forensics finish. A criminal investigation and legal review rarely produce quick ransomware confirmations. Expect updates on restored services, not on attackers.
- BYOD will publish sample data or go quiet. A group that claims 36,000 systems needs proof to keep pressure on. Silence would suggest the claim was oversized.
- Notification letters become likely if data theft is confirmed. Health systems that confirm exfiltration of personal or patient information face notice duties. The timing depends on how fast UNM’s investigators scope the data.
- Identity hardening moves up hospital budgets. Between BYOD’s Active Directory and Entra claims and Microsoft’s April 7, 2027 Entra Connect Sync deadline, identity teams get a calendar and a headline in the same quarter.
- Copycat positioning appears. Other new crews watch the free-keys-for-hospitals tactic. Our wider cybersecurity coverage will track whether it spreads or fades.
What Hospital Security Teams Should Do This Week
Defenders do not need to wait for UNM’s findings. The claim list reads like a checklist of what a hospital network exposes, and each item maps to a control worth testing now.
- Audit privileged identity. Count who holds domain admin and Entra global admin rights, and remove standing access. Where licensed, use Privileged Identity Management and risk-based protection from the P2 tier.
- Check Entra Connect Sync. Confirm your version is 2.6.84.0 or later and that application-based authentication is planned ahead of the April 7, 2027 deadline.
- Review Conditional Access exclusions. The All resources evaluation change can alter how old exclusions behave, so retest critical policies.
- Patch Oracle estate components. Read the October 2026 Critical Patch Update against your healthcare Oracle products, including patient-index components.
- Segment end-user devices from core systems. UNM’s reported split, endpoints hit and core servers spared, is the outcome segmentation is meant to produce.
- Rehearse downtime. Run a tabletop where the EHR is unavailable and ambulance diversion is the first decision.
The takeaway: UNM contained fast and reopened hospitals within a day, but the dispute over what BYOD actually took will run for weeks. Treat the 36,000 figure as unproven, treat the patient disruption as real, and use the gap to test your own controls.
Frequently Asked Questions
Was the UNM Health attack confirmed as ransomware?
No. UNM calls it a cybersecurity event and has not publicly identified ransomware, confirmed data theft, or named an attacker. The ransomware label comes from BYOD’s own claim and press monitoring of it.
Who is the BYOD ransomware group?
BYOD appears to be a newly emerged extortion group. Its members, infrastructure, malware, and history are not publicly verified, and the UNM listing is its first widely noticed claim.
Are UNM Hospital and clinics open now?
UNM reported that UNM Hospital and Sandoval Regional Medical Center were open on October 27, with ambulance traffic back to normal and clinics resuming scheduled appointments and procedures. Check UNM Health for current schedules.
Did hackers steal patient data from UNM Health?
BYOD claims it took patient, employee, student, payroll, and research data, but there is no independent confirmation. UNM has not verified the claim, and the investigation remains active.
Was the Cerner health record system breached?
Cerner appears only on BYOD’s list of claimed targets. No official statement from UNM or Oracle says the system was breached. Cerner is now marketed within Oracle Health.
What is BYOD’s $2,500 patient offer?
Monitoring of BYOD’s post reported an alleged offer of up to $2,500 per affected patient, plus free decryption keys for hospital-sector devices. Both are unverified claims by the attacker, not commitments from UNM.
Should I worry if I was a UNM patient or student?
Nothing is confirmed, but caution is cheap. Watch for official UNM notices, monitor financial accounts, and treat unexpected calls or emails about your records as suspect until you confirm them with UNM directly.
