Skip to content
NewA calmer, faster ZeroHour
StoryRansomwarehigh

UNM Health restores operations; BYOD theft claims unconfirmed

7 sources · 9 articlesFirst reported Updated ()1
What's new

October 29: DataBreaches.net, citing KOAT, adds that Chris Ramirez says data theft is unconfirmed, the FBI is investigating, and some staff and students must wait to power devices on.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

UNM Health says hospitals are fully functional and paid no ransom, while BYOD’s theft and $2,500 claims stay unconfirmed amid an FBI probe.

The University of New Mexico Health Sciences Center says hospitals are fully functional after an October 26 cyberattack that diverted ambulances and canceled outpatient care and health-sciences classes. Staff shut systems after detection around 11:30 a.m.; UNM announced the incident at 2:30 p.m. MDT, Infosecurity Magazine says hospitals had reopened by 10:27 p.m., and clinics resumed October 27 while classes stayed canceled. BleepingComputer reports UNM said only some end-user devices were affected, not core systems or servers. BYOD claims 36,000 compromised machines and stolen personal data; The Record says it later demanded $2,500 from individuals while offering free decryption keys. HSC says it paid no ransom, and on October 29 communications director Chris Ramirez said whether data was stolen is unknown while the FBI investigates.

Key facts
  • More than 30 clinics canceled Monday visits; UNM handles about one million visits a year.
  • Ambulances went to Albuquerque and Santa Fe; The Record first put diversions at about two hours.
  • BYOD claims Active Directory, Entra, two Oracle databases, and data including SSNs and Cerner records.
  • Health-sciences classes stayed canceled October 27; an Emergency Operations Center coordinated the response.
  • Some employees and students were told October 29 to wait before turning devices back on.
  • HSC told people not to contact claimants and to report messages to the FBI’s IC3.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026Breach detected around 11:30 a.m.; staff shut systems. · Help Net Security
  2. Oct 26, 2026UNM announced the incident at 2:30 p.m. MDT. · Infosecurity Magazine
  3. Oct 26, 2026Update said all UNM Health hospitals had reopened. · Infosecurity Magazine
  4. Oct 27, 2026Clinics resumed; health-sciences classes stayed canceled. · The Register
  5. Oct 27, 2026BYOD posted an apology and a $2,500 demand. · The Record
  6. Oct 29, 2026HSC said facilities were functional and no ransom was paid. · The Record

What each outlet adds

beyond the shared facts
  • SecurityWeekAnnual visit volumes and neighboring systems that accepted patients.
  • Help Net SecurityDetection around 11:30 a.m. and the order to shut systems.
  • BleepingComputerUNM said core systems and servers were not breached.
  • The RecordNo ransom paid; $2,500 individual demand and IC3 reporting advice.
  • DataBreaches.netRamirez says theft is unknown and some devices stay off.
Threat actors
ByodBYOD
Victims
University of New Mexico Health Sciences CenterUniversity of New MexicoUNM Health Sciences CenterUniversity of New Mexico Health SystemUniversity of New Mexico HospitalUniversity of New Mexico Health
Organizations
VenariXFBIPresbyterian Healthcare ServicesLovelace Health System
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 3d ago SecurityWeekFirst report

    UNM Health System diverts patients after unspecified cybersecurity issue

    New Mexico's only Level 1 trauma center later resumed operations in phases; on-screen data-theft claims remain unconfirmed.

  2. · 3d ago Help Net Security

    Cyberattack disrupts University of New Mexico hospitals

    Ambulances were diverted Monday and clinics resume Tuesday; BYOD’s theft and 36,000-machine claims are unconfirmed.

  3. · 3d ago The Record

    University of New Mexico hospital diverts ambulances after cyberattack

    Outpatient care was canceled Monday; classes stay closed Tuesday while a law-enforcement investigation continues.

  4. · 3d ago The Register · Security

    UNM cancels second day of health classes after cyberattack

    Hospitals resumed accepting patients after Monday ambulance diversions, while BYOD's ransomware and data-theft claims remain unverified.

  5. · 3d ago Infosecurity Magazine

    UNM Health cancels surgeries after cyber incident; BYOD claims attack

    Hospitals reopened later on October 26, while health-sciences classes stayed canceled through October 27.

  6. · 3d ago DataBreaches.net

    UNM Health diverts ambulances and cancels clinics after cyberattack

    More than 30 clinics canceled visits, and medicine, nursing and pharmacy classes stayed canceled a second day.

  7. · 3d ago BleepingComputer

    UNM Health ransomware attack disrupts patient care and surgeries

    The Byod gang claims it stole patient and employee data from 36,000 systems; UNM says core systems were not breached.

  8. · 1d ago The Record

    University of New Mexico restores hospital systems after ransomware attack

    HSC says it paid no ransom; the BYOD gang claims it will keep data unless individuals pay $2,500.

  9. · 1d ago DataBreaches.net

    UNM Health addresses cyberattack after ransomware group claims responsibility

    UNM says operations are normal while the FBI investigates whether patient data was stolen; the group is unnamed.