Ransomware Attack on UNM Health Halts Surgeries, Diverts Ambulances

The University of New Mexico Health Sciences Center identified a cybersecurity event late on Monday morning, October 26. Within roughly ninety minutes, its hospitals stopped accepting ambulance traffic altogether. The ransomware attack on UNM Health sent emergency patients to other area facilities.

The university also cancelled every clinic appointment and outpatient surgery booked for that day, and told patients to stay away from its sites entirely. For a genuine emergency, the instruction stayed the same: call 911.

What made that decision so consequential is the position UNM Hospital holds in the state. The Albuquerque facility runs more than 600 inpatient beds and houses New Mexico’s only Level I trauma center. Nowhere else in the state handles the most severely injured patients. Sandoval Regional Medical Center fell under the same shutdown, because it belongs to the same health system.

IT staff began containment work as soon as they identified the threat. The university alerted state and federal law enforcement the same day, and the FBI’s Albuquerque division has confirmed it is assisting. UNM calls the matter an active criminal investigation, which it says limits further disclosure.

What the Ransomware Attack on UNM Health Shut Down

The disruption from the ransomware attack reached well past clinical care at UNM Health. The university cancelled all classes on the Health Sciences campus and sent nonessential employees home to protect the network. That covered the schools of medicine, nursing, pharmacy and population health, including online and remote instruction.

Classes at UNM’s Central and branch campuses carried on as normal, which points to the shape of the containment strategy. The Health Sciences network became the compromised perimeter, and the university walled it off from everything else. That approach kept the wider institution running while UNM Health worked through the ransomware attack.

By early Tuesday afternoon, UNM reported that critical electronic systems were back online. Hospitals reopened fully, ambulance traffic returned to normal routing, and clinics resumed scheduled appointments. The university credited internal security teams working alongside external partners for the pace of that recovery.

The speed of the turnaround deserves attention, because the ransomware attack on UNM Health produced a clinical outage measured in hours. Comparable healthcare incidents drag on far longer, with electronic health record systems down for weeks.

UNM Says Core Systems Held While Attackers Claim Total Compromise

From here the story splits, because the ransomware attack at UNM Health has produced two accounts that cannot both be true. The university’s own assessment found that the event touched some end-user devices but did not reach core systems or servers. That is a narrow conclusion, and it fits the speed of the recovery.

An extortion crew calling itself Byod has claimed the ransomware attack on UNM Health, and its account runs much wider. The group says it compromised 36,000 systems across the main campus and hospital environments. Its list includes Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant and two Oracle databases.

Byod also claims access to Social Security numbers, payroll and HR records, and Banner student records. The list extends to internal emails, research data, patient information and Cerner electronic health record rosters. The group said it would pull the listing once the university made contact, a standard negotiation opener. Nobody has verified those claims, and UNM has not answered the data theft allegations.

Why Attacker Claims Deserve Scepticism

Extortion groups inflate their numbers as a matter of routine. A leak site post works as a pressure instrument, and exaggerated scope costs the attacker nothing. A figure like 36,000 compromised systems arrives with no evidence attached. Groups also count every endpoint they brushed against rather than every system they controlled.

Early victim assessments lean the other way, though. Forensic investigations revise initial findings upward often enough that a nearly all-clear carries little weight. So the full scope of the ransomware attack on UNM Health remains unestablished, and anyone claiming otherwise is guessing.

The Group Behind the Claim

Byod arrived on the scene recently and carries a thin track record. The group lists six victims on its data leak site and has published allegedly stolen data for three of them. Nobody can yet say how it behaves once a victim engages.

Its public positioning deserves a look for how carefully the group built it. The FAQ page frames the activity as penetration testing meant to expose vulnerabilities and hold data controllers accountable. Byod says no target sits off limits, but it picks victims after an assessment. The group claims to go after organisations that treat customers as revenue line items.

In a follow-up post, the group offered free decryption keys to healthcare facilities. It also promised up to $2,500 per patient affected by the ransomware attack at UNM Health. Byod described itself as having morals and a heart while promising to keep holding companies responsible for weak security. In the same message, it confirmed it intends to keep all the stolendata.

That combination collapses under the weight of its own contradiction. An operation holding stolen patient records while advertising compensation for those same patients is running a reputation campaign. The two positions cannot hold at once.

What Patients and Staff Should Do Now

UNM has told patients, staff and students to watch for unsolicited contact and phishing attempts. That guidance carries real weigh there. Criminals name confirmed incidents in phishing lures because the reference lends instant credibility. A widely reported ransomware attack at UNM Health hands them a ready-made hook.

Anyone connected to UNM Health should treat unexpected emails, texts and calls referencing the ransomware attack with suspicion. Messages asking for personal details, payment information or account credentials deserve particular caution. Real breach notifications arrive through official channels and never demand action within the hour.

Relevant history sits behind this incident as well. UNM Health notified more than 637,000 patients after a separate cybersecurity event that surfaced in 2021. That figure gives a rough sense of how much personal data the system holds.

What Hospitals Should Take From the Ransomware Attack on UNM Health

Strip away the competing claims and one fact holds regardless of how the investigation lands. The ransomware attack on UNM Health forced ambulances away from the only Level I trauma center in New Mexico. That happened because the organisation put patient safety ahead of continuity once its systems stopped looking trustworthy.

Diversion is the right call when staff cannot trust clinical systems, but it moves risk rather than removing it. Critically injured patients end up at facilities that may sit further away and carry less capability. In a state this large with one top-tier trauma resource, those extra minutes matter.

The fast restoration suggests the first-hour decisions worked. Isolating the Health Sciences network, pulling nonessential staff off systems and bringing in outside expertise early all shortened the outage. Hospitals watching this should test their own downtime procedures now. Recovering from a ransomware attack as fast as UNM Health did takes rehearsal rather than luck.