Short answer
UNM Health says it contained a cybersecurity event on October 26, 2026 that briefly diverted ambulances and suspended clinics. The university says the event did not penetrate core systems or servers and that it made no concessions to any group. A group called Byod claims it stole data, and that claim is unverified.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | University of New Mexico Health System (UNM Health) |
|---|---|
| Incident type | Extortion |
| Status | Under investigation |
| Sector | Healthcare |
| Country | United States |
| Detected | 2026-10-26 |
| Disclosed | 2026-10-26 |
| People or records affected | Unknown. UNM has not said whether any data was accessed. A group called Byod claims it holds patient, employee and student data, which UNM has not confirmed. |
What data was exposed
- Not confirmed by UNM. UNM says the event affected some end-user devices and did not penetrate core systems or servers.
- Claim by the Byod group, unverified: Social Security numbers, HR and payroll records, student records, internal emails, research data, hospital appointment data and patient information
What happened
On Monday, October 26, 2026, the University of New Mexico’s Health Sciences Center reported a cybersecurity event. According to UNM’s own newsroom, containment began around 11 a.m. From 12:30 to 2:30 p.m. the system limited new patient intake and diverted ambulances to other hospitals in Albuquerque and Santa Fe. Outpatient surgeries and appointments were suspended for the rest of the day.
The Associated Press reported that the disruption left the state without an emergency department able to treat the most serious injuries, because UNM runs the state’s only Level 1 trauma center. Presbyterian Healthcare Services and Lovelace Health System said they were coordinating with UNM and taking on additional patients.
What UNM has confirmed
UNM’s updates say its IT teams contained the event, notified state and federal law enforcement and brought in outside partners. By October 27 the hospitals were fully open and clinics had resumed. The response team’s assessment, UNM said, found that the event affected some end-user devices and “did not penetrate core systems or servers.” On October 28 the university said classes and research had restarted and that it “did not make concessions with any group behind the threat.”
UNM says the incident is under criminal investigation, which limits what it can release. An FBI spokesperson told AP the agency was assisting its partner.
What the attackers claim
AP reported that several employees saw messages on their computers on Monday morning claiming student, employee and patient data had been stolen. BleepingComputer found that a new group called Byod claimed the attack, saying it had compromised 36,000 systems, including the university’s Active Directory and two databases, and listing Social Security numbers, payroll and patient information among the data it holds. These are the group’s claims. Neither outlet verified them, and they conflict with UNM’s statement that core systems were not penetrated.
What is still unknown
UNM has not said whether any data was accessed or copied, and it has not named the attacker or the method. If notification letters are sent, they will say what was involved. Until then, assume that messages mentioning the incident could be bait. Our guide to what to do after a data breach covers freezes and monitoring, and the typical lures are described in phishing messages and urgent-payment scams. See our editorial policy for how we label claims.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Messages offering payment or compensation to patients, which UNM itself warned may follow the incident
- Emails, texts or calls from people claiming to be the attackers or to represent UNM, asking you to click a link or confirm personal details
- Fake patient-portal or appointment-reschedule messages that copy the real rescheduling notices
- Phishing aimed at UNM staff and students that uses the incident as bait
What to do if you are affected
- 01Do not respond to or engage with anyone claiming responsibility for the attack, and do not click links, open attachments or download files from them.
- 02If you are contacted, keep the message and report it to the FBI at IC3.gov or 1-800-CALL-FBI, as UNM advises.
- 03Reschedule missed appointments only through UNM Health's official channels, and look up the number yourself rather than calling one in a message.
- 04Use unique passwords, turn on multifactor authentication and keep your devices updated.
- 05Read your health insurance statements for services you did not receive, and visit IdentityTheft.gov if you see signs of identity theft.
Frequently asked questions
Was patient data stolen in the UNM Health cyberattack?
UNM has not said. It states that the event affected some end-user devices and did not penetrate core systems or servers. A group called Byod claims it holds patient data, but BleepingComputer could not verify that and UNM did not respond to its questions about it.
Was it ransomware?
UNM has not said what type of attack it was. BleepingComputer reports that Byod, a new group, claimed the attack on its leak site. UNM says it made no concessions to any group behind the threat.
Is UNM Hospital open now?
Yes. UNM said on October 27 that all UNM Health hospitals were fully open and ambulance traffic was back to normal. On October 28 it said clinical operations were fully functional and classes and research had resumed.
Should I accept a payment offer from the attackers?
No. UNM warns that offers of payment or compensation may follow and tells people not to engage. Keep the message and report it to the FBI at IC3.gov.
What should I do if I am a UNM patient?
Rely only on official UNM Health channels for appointment changes, watch your insurance statements, and be cautious with unexpected messages that mention the incident.
Sources
- Ambulance traffic diverted, clinical appointments cancelled and classes cancelled due to cybersecurity issue at UNM HSC (with updates through Oct. 28), UNM Health Sciences Center newsroom, 2026-10-28
- A cybersecurity issue forces a major New Mexico hospital to divert patients and close clinics, Associated Press, 2026-10-26
- UNM Health ransomware attack disrupts patient care, surgeries, BleepingComputer, 2026-10-27
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.