UNM Health Sciences Center hit by cyberattack: ambulances diverted, clinics closed; new BYOD ransomware group claims 36,000 machines (unverified)
Matéria consolidada. Reúne 10 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 7 fontes trouxeram em 06/11/2026 12:09; os links antigos trazem para cá.
Fontes: securityaffairs.com ↗ fortra.com ↗ hipaajournal.com ↗ bleepingcomputer.com ↗ infosecurity-magazine.com ↗ theregister.com ↗ securityweek.com ↗
The University of New Mexico Health Sciences Center (UNM HSC), which includes the UNM Health clinical system, disclosed a "cybersecurity event" on Monday 26 October 2026 at 14:30 MDT (theregister.com, infosecurity-magazine.com). Containment began at about 11 a.m. that day, and ambulance traffic was diverted from 12:30 to 2:30 p.m. (hipaajournal.com). UNM also limited admissions, cancelled surgeries and appointments at more than 30 clinics, and turned patients away from its main Albuquerque hospital (securityweek.com, bleepingcomputer.com). UNM operates the state's only Level 1 trauma center, so Presbyterian Healthcare Services and Lovelace Health System took additional patients (securityweek.com, securityaffairs.com), and the disruption carried a serious patient-safety risk (hipaajournal.com). Services returned in phases: all UNM Health hospitals had reopened by 10:27pm on 26 October, and clinics resumed scheduled care on 27 October (infosecurity-magazine.com, theregister.com). Critical systems were back online in the early hours of 27 October (hipaajournal.com), and UNM said all critical electronic systems were back online by 27 October (bleepingcomputer.com). A new ransomware group, BYOD (also written Byod), claimed the attack on its leak site, but UNM has not confirmed the claim, the attack type, whether patient data was accessed, or any perpetrator. The FBI is assisting an active law enforcement investigation (securityweek.com), which is described as a criminal investigation (hipaajournal.com, securityaffairs.com). Later write-ups (fortra.com, 29 October) repeat that a ransomware group disrupted operations, with ambulances diverted, surgeries cancelled and medical students sent home, but add no attribution, malware family or indicators. The most recent write-up (securityaffairs.com, 5 November) restates UNM's position that only end-user devices were affected and core systems and servers were not compromised, and adds no new technical findings or attribution.
Detalhes técnicos
- Employees reported messages on their computers late Monday morning claiming theft of student, employee and patient data (securityweek.com). Josephine Wolff (Tufts University) noted that displaying a message on computers is unusual compared with the long-running pattern of ransomware against hospitals (securityweek.com). securityaffairs.com also describes the employee reports of data theft as unverified.
- UNM says its IT security teams contained the event, notified state and federal law enforcement, engaged external partners and activated an Emergency Operations Center (theregister.com, securityaffairs.com). Some end-user devices were affected, but UNM says it kept the threat actor away from its core systems and servers (hipaajournal.com). securityaffairs.com reports UNM detected the threat around 11 a.m., isolated the affected end-user devices, and contained it within roughly 24 hours. It is unconfirmed that any ransomware payload was deployed (theregister.com). No initial access vector, malware or IOCs have been published; fortra.com and securityaffairs.com likewise disclosed no malware family or technical indicators.
- BYOD claims it compromised 36,000 machines, both Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant and two Oracle databases (theregister.com, bleepingcomputer.com). hipaajournal.com reports the group claims 36,000 systems at the UNM main campus and UNM Health. All of this is unverified.
- Claimed stolen data includes Social Security numbers, HR and payroll records, Banner student records, hospital appointment data, student and employee PII, research data and internal emails (bleepingcomputer.com, infosecurity-magazine.com). The group also claims patient data and Cerner EHR rosters (hipaajournal.com). The group posted: "This is your entire network and infrastructure compromised, the entire university COMPLETELY" (infosecurity-magazine.com). VenariX reported the leak-site claim on X (infosecurity-magazine.com).
- BYOD said it would remove the post once the university opened communication, which likely means ransom negotiation. In a later post it offered free decryption keys for healthcare facilities and promised up to $2,500 per affected patient, while stating it would keep the stolen data (bleepingcomputer.com). hipaajournal.com adds that the group said it did not know the hospital ran systems supporting real-time patient care, and that the decryption keys were offered for the hospital sector only. It describes its activity as "pentesting" to hold data controllers accountable (bleepingcomputer.com).
- BYOD is newly formed. Its leak site listed six victims, three with leaked data, per bleepingcomputer.com, and 10 victims per the later hipaajournal.com. Its first named victim was Trump Mobile (data allegedly leaked for 3,615 customers), a claim that appears to have held up (theregister.com). A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be the same group (theregister.com).
- Operational impact: besides cancelled appointments at more than 30 clinics, outpatient surgeries were suspended and the Health Sciences Center closed classes (securityaffairs.com). The disruption temporarily left New Mexico without its only Level 1 trauma center (securityaffairs.com).
- Academic impact: students at the School of Medicine, College of Pharmacy, College of Nursing and College of Population Health were told to leave campus. Classes there, including online ones, were cancelled on 26 and 27 October, and non-essential HSC staff were told to stay home. Central and branch campuses were not affected (infosecurity-magazine.com, theregister.com). fortra.com also reports medical students sent home and classes suspended. UNM HSC handles over one million patient visits a year (infosecurity-magazine.com).
Remediação
- No technical remediation guidance or IOCs have been published. External cybersecurity partners are assisting with remediation, law enforcement has been notified, and UNM has launched an investigation into the nature and scope of the unauthorized access (hipaajournal.com).
- UNM says recovery continues in phases and it will work with patients to reschedule missed appointments and procedures (infosecurity-magazine.com, theregister.com).
- UNM advises patients, staff and students to stay vigilant for unsolicited communications and phishing and fraud attempts referencing the incident, pending confirmation of any data theft (bleepingcomputer.com, securityaffairs.com).
- Healthcare and education defenders should review Active Directory and Entra ID exposure and credential hygiene, and monitor for the data types the actor claims to hold (bleepingcomputer.com).
Relatos divergentes
- Scope of compromise: BYOD claims 36,000 machines, both AD forests and the whole Entra tenant (theregister.com, bleepingcomputer.com), and hipaajournal.com says it frames the 36,000 systems as covering the UNM main campus and UNM Health. UNM's assessment with external partners found only some end-user devices affected, with no penetration of core systems or servers (bleepingcomputer.com; repeated by hipaajournal.com and, most recently, securityaffairs.com, which states core systems and servers were not compromised). Central and branch campuses were reported unaffected (infosecurity-magazine.com, theregister.com). The actor's claims remain unverified.
- Nature of the attack: BYOD is described as a ransomware group (theregister.com, infosecurity-magazine.com, bleepingcomputer.com, hipaajournal.com), and fortra.com states flatly that a ransomware group attacked UNM HSC, but theregister.com notes it is unconfirmed that ransomware was deployed. securityweek.com, the earliest report, saw only on-screen messages claiming data theft and named no actor; securityaffairs.com, the most recent source, calls it a cybersecurity incident under criminal investigation and names no actor or ransomware.
- Meaning of "BYOD": fortra.com describes the intrusion as linked to "BYOD (bring your own device)" exposure, as if it were an attack vector. The other sources (theregister.com, bleepingcomputer.com, infosecurity-magazine.com, hipaajournal.com) identify BYOD as the name of the claiming ransomware group, and no source confirms a bring-your-own-device vector. fortra.com itself discloses no attribution, malware or indicators, so this reading appears to be a misinterpretation of the group name.
- Data theft: The theft claims, from the on-screen messages and the leak site, have not been confirmed by UNM. hipaajournal.com notes UNM has not confirmed whether patient data was accessed; securityaffairs.com likewise calls the reports unverified.
- Operational status: securityweek.com reported phased resumption on 26 October. Later sources (infosecurity-magazine.com, theregister.com, bleepingcomputer.com) report hospitals reopened that night and clinics back to normal schedules on 27 October, with classes still cancelled for a second day. hipaajournal.com places critical systems back online in the early hours of 27 October. securityaffairs.com, the most recent, says restoration began the afternoon of 26 October and operations were normal by the next day.
- Timing of detection and containment: hipaajournal.com says containment began at about 11 a.m. on 26 October, while securityaffairs.com says UNM detected the threat around 11 a.m. and contained it within roughly 24 hours. The sources differ on whether 11 a.m. marks detection or the start of containment; UNM's own statement is not in the input.
- BYOD victim count: bleepingcomputer.com listed six victims, while hipaajournal.com, the more recent source, reports 10 on the leak site.
Linha do tempo
-
UNM Health Cyberattack Disrupts New Mexico's Only Level 1 Trauma Center, Diverts Patients
ler a análise desta fonte ocultar
On October 26, 2026, the University of New Mexico Health System (UNM Health) suffered a cybersecurity incident that forced the diversion of ambulance traffic, cancellation of appointments at more than 30 clinics, suspension of outpatient surgeries, and closure of classes at its Health Sciences Center. The disruption temporarily left New Mexico without its only Level 1 trauma center, pushing extra strain onto nearby hospitals such as Presbyterian Healthcare Services and Lovelace Health System, which absorbed diverted patients. UNM said IT security teams detected the threat around 11 a.m., isolated affected end-user devices, and confirmed core systems and servers were not compromised. Systems began being restored the same afternoon, and operations returned to normal by the next day. The incident remains under criminal investigation; employees reported unverified claims that patient, student and staff data had been stolen, and UNM warned of potential phishing attempts exploiting the event.
Technical Details
UNM Health activated an Emergency Operations Center, engaged outside cybersecurity support, and notified state and federal law enforcement. The organization stated the threat affected end-user devices rather than core infrastructure or servers, and contained it within roughly 24 hours.
Remediation
UNM Health advised patients, students and staff to be alert for phishing and fraud attempts referencing the incident, pending confirmation of any data theft.
-
Ransomware attack on University of New Mexico Health Sciences Center diverts ambulances and cancels surgeries
ler a análise desta fonte ocultar
A ransomware group attacked the University of New Mexico Health Sciences Center (HSC), causing significant operational disruption. According to the report, ambulances were diverted, surgeries were cancelled, and medical students were sent home as classes were suspended. The intrusion is described as linked to BYOD (bring your own device) exposure. No threat actor attribution, malware family or technical indicators were disclosed in the article.
-
UNM Health diverts ambulances and cancels appointments after cyberattack claimed by new ransomware group Byod
ler a análise desta fonte ocultar
The University of New Mexico Health System (UNM Health) detected a cyberattack on October 26, 2026 that disrupted critical electronic systems across the University of New Mexico Health Sciences Center. Ambulance traffic was diverted from 12:30 to 2:30 p.m., appointments and outpatient surgeries were cancelled, and students were told to leave campus. Critical systems were back online in the early hours of October 27, and clinics resumed regular appointments that day. A new ransomware group, Byod, has claimed responsibility. UNM has not confirmed the nature of the attack or whether patient data was accessed, and the incident is under criminal investigation.
Technical Details
- Containment began at about 11 a.m. on October 26. Some end-user devices were affected, but UNM says it kept the threat actor away from its core systems and servers.
- Byod claims it compromised 36,000 systems at the UNM main campus and UNM Health. It also claims it exfiltrated patient, student and employee data, payroll information, internal emails and Cerner EHR rosters. These claims are unverified.
- The group later said it did not know the hospital ran systems supporting real-time patient care. It offered free decryption keys for the hospital sector only and said it will keep the stolen data. It also offered patients up to $2,500 each. Its leak site lists 10 victims.
- UNM Hospital is the only level 1 trauma center in New Mexico, so the disruption carried a serious patient-safety risk.
Remediation
- External cybersecurity partners are assisting with remediation, and law enforcement has been notified.
- UNM has launched an investigation into the nature and scope of the unauthorized access.
-
Byod ransomware claims attack on UNM Health, disrupting hospital admissions, ambulance intake and surgeries
ler a análise desta fonte ocultar
The University of New Mexico Health Sciences Center (UNM Health) disclosed a cyberattack on Monday that caused system outages. UNM limited new patient admissions, diverted ambulances, and suspended outpatient surgeries and appointments. UNM Hospital and Sandoval Regional Medical Center stayed open, and UNM later said all critical electronic systems were back online and clinics had resumed scheduled care. A new ransomware group, Byod, claimed the attack on its leak site and alleged theft of sensitive student, employee and patient data. UNM has not confirmed the claims and says the event affected some end-user devices but did not penetrate core systems or servers.
Technical Details
- UNM has not disclosed the type of attack. Byod claims it compromised 36,000 systems across the main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant and two Oracle databases (unverified threat actor claim).
- Claimed stolen data: Social Security numbers, HR, payroll and Banner student records, and hospital appointment data.
- Byod said it would remove the breach post once the university opened communication, which is likely a ransom negotiation. In a later post it offered free decryption keys for healthcare facilities and promised up to $2,500 per affected patient, while stating it would keep the stolen data.
- Byod is a new group with six listed victims, three of which have had data leaked. It describes its activity as "pentesting" to hold data controllers accountable.
- UNM's assessment, done with external partners, found only some end-user devices affected.
Remediation
- UNM advises patients, staff and students to stay vigilant for unsolicited communications and phishing attempts.
- Defenders in healthcare and education should review Active Directory and Entra ID exposure and credential hygiene, and monitor for the data types the actor claims to hold.
-
BYOD ransomware group claims attack on UNM Health Sciences Center; surgeries cancelled and ambulances diverted
ler a análise desta fonte ocultar
The University of New Mexico Health Sciences Center (UNM HSC) disclosed a cyber incident on Monday 26 October at 2:30pm MDT. It cancelled all appointments and scheduled surgeries for the day, and ambulances were diverted. Patients were told to use 911 for emergencies and to delay non-emergency care. Operations resumed in phases, all UNM Health hospitals had reopened by 10:27pm, and clinics were due to return to normal schedules on 27 October. The emerging ransomware group BYOD reportedly claimed the attack on its data leak site, according to cybersecurity intelligence firm VenariX on X. UNM has not confirmed the nature of the incident or any perpetrator.
Technical Details
- BYOD claims it compromised 36,000 machines and exfiltrated sensitive data. The claimed data includes student and employee PII, research data, student records and internal emails. This is unverified.
- The group posted: "This is your entire network and infrastructure compromised, the entire university COMPLETELY."
- Systems were brought back online in phases "as it was safe to do so".
- Students at the School of Medicine, College of Pharmacy, College of Nursing and College of Population Health were told to leave campus. Classes there, including online ones, were cancelled on 26 and 27 October, and non-essential staff were sent home. Central and branch campuses were not affected.
- UNM HSC handles over one million patient visits a year (about 900,000 outpatient and 100,000 emergency room visits) and had 2,670 students enrolled in 2025.
Remediation
No technical remediation guidance was published. UNM said it will work with patients to reschedule missed appointments and procedures.
-
University of New Mexico Health Sciences Center hit by cyberattack; BYOD group claims responsibility
ler a análise desta fonte ocultar
The University of New Mexico (UNM) Health Sciences Center (HSC), which includes the UNM Health clinical system, disclosed a "cybersecurity event" on 26 October 2026. UNM shut down systems, cancelled appointments and clinics, and diverted ambulances to facilities in Albuquerque and Santa Fe. Classes in the medicine, nursing and pharmacy faculties were cancelled for a second day, and hospital appointments and clinics resumed on 27 October, with nonessential HSC staff told to stay home. UNM has not disclosed the nature of the attack. The newly formed BYOD ransomware group claimed responsibility, but the claim is unverified and it is unconfirmed that any ransomware payload was deployed.
Technical Details
- UNM announced the incident at 14:30 local time on 26 October, dismissing all but critical and clinical staff.
- UNM says its IT security teams contained the event, notified state and federal law enforcement, engaged external partners and activated an Emergency Operations Center.
- BYOD claims it compromised 36,000 machines, both Active Directory forests, two Oracle databases, personal data of every student and employee, internal emails and data from other systems. None of this is verified.
- BYOD's first named victim was Trump Mobile (data allegedly leaked for 3,615 customers), a claim that appears to have held up. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two groups could be the same.
Remediation
UNM says recovery will continue in phases. No technical guidance or IOCs were published.
-
University of New Mexico Health System hit by cyber incident, diverts ambulances and closes 30+ clinics
ler a análise desta fonte ocultar
The University of New Mexico Health System (UNM Health) suffered a cybersecurity incident on Monday that forced it to divert ambulances, turn patients away from its main Albuquerque hospital and cancel appointments at more than 30 clinics. The network operates the state's only Level 1 trauma center, so New Mexico was left without an emergency department able to treat the most serious injuries. Presbyterian Healthcare Services and Lovelace Health System coordinated with UNM and took additional patients. Operations began resuming in phases later the same day. The nature and scope of the incident were not disclosed, and the FBI is assisting an active law enforcement investigation.
Technical Details
- Multiple employees reported that messages appeared across their computers late Monday morning claiming theft of student, employee and patient data. The claim is unverified.
- No threat actor, malware, initial access vector or ransom demand has been named. UNM declined to comment, citing the active investigation.
- Josephine Wolff (Tufts University) noted that breaching a system to display a message on computers is unusual, unlike the long-running pattern of ransomware against hospitals.
- The UNM Health Sciences Center also canceled classes.
Remediation
No remediation guidance was published. UNM said it was working to resolve the issue and restoring services in phases.