A new gang calling itself Byod claimed the attack, then offered free decryption keys — while the hospital insists its core systems were never reached.

For about two hours on Monday 26 October, ambulances in Albuquerque were told to take their patients somewhere else. The University of New Mexico Health System — which runs UNM Hospital, the state's only Level I trauma center — had detected a cyberattack that morning and, to keep patients safe, temporarily closed its doors to new arrivals while its IT teams fought to contain it.

By the evening of the following day, the hospital's critical systems were back online. But the incident has since turned into a public argument between the health system and a new ransomware gang over what really happened inside its network.

What happened

UNM Health's security teams identified the threat on the morning of Monday 26 October and began containment at around 11 a.m. The impact on care was immediate. All appointments at UNM Health facilities were cancelled for that day, outpatient surgeries were called off, and the system temporarily limited acceptance of new patients. From 12:30 to 2:30 p.m., all ambulance traffic was diverted to other hospitals in Albuquerque and Santa Fe, which worked with UNM Health to cover the gap.

The disruption spread beyond the hospital. The outage affected the entire UNM Health Sciences Center: students at the School of Medicine, the College of Pharmacy, the College of Nursing and the College of Population Health were asked to leave the campus on Monday, and classes were cancelled again on Tuesday.

The recovery, by hospital standards, was fast. Clinics resumed scheduled appointments on Tuesday 27 October, ambulance traffic returned to normal, and classes resumed on Wednesday. UNM says its containment largely worked: some end-user devices were hit, but the attacker was kept out of its core systems and servers.

The gang's claims

UNM Health itself has not named the type of attack. But a new ransomware operation calling itself Byod has claimed responsibility on its data leak site, and its version of events is far more dramatic. The group claims it compromised 36,000 systems across the university's main campus and hospital environments, and says it exfiltrated patient, student and employee data — including Social Security numbers, payroll information, internal emails and rosters from the Cerner electronic health record system.

None of that has been confirmed. UNM Health has publicly urged skepticism about the gang's claims and stood by its own findings that core systems were not penetrated. The health system also said it has made no concessions to the hackers. Law enforcement has been notified, the FBI is conducting a forensic analysis, and the incident is under criminal investigation — which is one reason official details remain limited.

An apology, with a catch

A day after claiming the attack, Byod added an unusual follow-up post. The group said it had not realised UNM Health was "running machines related to assisting patients in real-time," and offered to hand over decryption keys for the hospital sector for free, even promising to pay up to $2,500 to each affected patient. "We have morals, and we have a heart, we are not villains," the group wrote.

Read that offer carefully, though: in the same breath, the gang said it would keep the data it claims to have stolen. An apology that ends with keeping the goods is not really an apology — it is public relations from a group that is barely a month old and lists around ten victims on its leak site. Claims and offers like these also create a scam risk of their own, as copycats can pose as the gang and contact patients directly.

What we still don't know

The central question — whether any patient or employee data was actually taken — remains unanswered. UNM Health says it is still waiting on the forensic work to determine whether patient data was compromised, and no official count of affected people exists yet. We also do not know how the attackers first got in. Until the investigation reports, the honest position is the uncomfortable one: the disruption to care is confirmed fact, while the data theft is, so far, a criminal group's claim.

What this means for you

• Treat "compensation" messages as scams. If anyone contacts you claiming to be the gang, the hospital, or a lawyer offering payment over this incident, do not engage. UNM Health and the FBI advise reporting such messages to the FBI's Internet Crime Complaint Center at IC3.gov.
• If you are a UNM patient or employee, watch for official notices. Breach notifications, if any come, will arrive through the health system's own channels — not through links in unexpected emails or texts.
• Freeze your credit if your data is ever confirmed stolen. Social Security numbers cannot be changed, so a credit freeze is the strongest protection if this — or any hospital breach — turns out to include yours.
• Keep perspective, not panic. Hospitals plan for downtime precisely because attacks like this happen; care in Albuquerque continued at neighbouring facilities throughout the incident.

Sources

• The HIPAA Journal, "University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack", 28 October 2026
• Fortra, "BYOD Cyberattack Diverts Ambulances and Cancels Classes at University of New Mexico Health Center", 29 October 2026
• Government Technology, "No Concessions to Hackers in UNM Health Center Attack", 29 October 2026

Related reading: Your Data Was in a Breach. Do These 7 Things Today · Was Your Email in a Data Breach? How to Check Safely