University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack
The University of New Mexico Health System (UNM Health) has experienced a cyberattack that has prevented access to critical electronic systems. The incident was detected on October 26, 2026, and as a precaution to ensure patient safety, all ambulance traffic was temporarily diverted to alternative hospitals. A decision was made to cancel all appointments at UNM Health facilities on October 26. UNM Health explained in a 2:30 p.m. update on October 26 that it was also temporarily limiting the acceptance of new patients while efforts continued to restore access to key systems.
Other health systems in Albuquerque and Santa Fe have been working with UNM Health to ensure that patients receive the care they need. UNM Health operates UNM Hospital in Albuquerque, the only level 1 trauma center in New Mexico, so the cyberattack had the potential to place patient safety at serious risk. According to UNM Health’s announcement, the incident caused a system outage that affected the entire University of New Mexico Health Sciences Center. On October 26, all students at the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health were requested to leave the campus, and classes were also cancelled on Tuesday.
UNM Health was able to quickly start restoring access to systems, and confirmed in a 10:27 p.m. update that all UNM Health hospitals remain open, and clinics would resume regularly scheduled appointments on October 27, 2026. In the early hours of October 27, 2026, UNM Health confirmed that critical systems had been brought back online at The University of New Mexico Health Sciences Center, and ambulance traffic had returned to normal operations. The divert lasted from 12:30 to 2:30 p.m. on October 26. UNM Health said the cancellation of appointments and outpatient surgeries was necessary while IT teams worked to protect the network.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Containment efforts began at around 11 a.m. on October 26, which were largely successful. While some end user devices were impacted, UNM was able to prevent the threat actor from reaching its core systems and servers. External cybersecurity partners assisted with the remediation efforts, and an investigation has been launched to assess the nature and scope of the unauthorized access.
Law enforcement has been notified, and the incident is under criminal investigation, so limited information about the nature of the attack can be disclosed at this time. It is naturally too early to determine the extent to which patient data was involved. While UNM Health has not disclosed details about the nature of the attack, this appears to have been an attempted ransomware attack. A new ransomware group called Byod has claimed it was responsible. The group’s data leak site currently lists 10 victims.
The group’s post about the attack suggests that 36,000 systems at the UNM main campus and UNM Health were compromised, and that patient, student, and employee data was exfiltrated, along with payroll information, internal emails, and Cerner EHR rosters. The group later backtracked to a degree, adding a further post stating it was unaware that “[UNM Health] was running machines related to assisting patients in real-time,” and offered to provide certain decryption keys for free. “(we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only… To any patient that was affected, we will pay you up to $2,500 each for the inconvenience. We are sorry once again. We have morals, and we have a heart, we are not villains, but we will still hold companies responsible for bad security leading to compromise of any customer data.”
