UNM Health Sciences Center hit by cyberattack: ambulances diverted, clinics closed; new BYOD ransomware group claims 36,000 machines (unverified)
Matéria consolidada. Reúne 8 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 6 fontes trouxeram em 30/10/2026 00:09; os links antigos trazem para cá.
Fontes: fortra.com ↗ hipaajournal.com ↗ bleepingcomputer.com ↗ infosecurity-magazine.com ↗ theregister.com ↗ securityweek.com ↗
The University of New Mexico Health Sciences Center (UNM HSC), which includes the UNM Health clinical system, disclosed a "cybersecurity event" on Monday 26 October 2026 at 14:30 MDT (theregister.com, infosecurity-magazine.com). Containment began at about 11 a.m. that day, and ambulance traffic was diverted from 12:30 to 2:30 p.m. (hipaajournal.com). UNM also limited admissions, cancelled surgeries and appointments at more than 30 clinics, and turned patients away from its main Albuquerque hospital (securityweek.com, bleepingcomputer.com). UNM operates the state's only Level 1 trauma center, so Presbyterian Healthcare Services and Lovelace Health System took additional patients (securityweek.com), and the disruption carried a serious patient-safety risk (hipaajournal.com). Services returned in phases: all UNM Health hospitals had reopened by 10:27pm on 26 October, and clinics resumed scheduled care on 27 October (infosecurity-magazine.com, theregister.com). Critical systems were back online in the early hours of 27 October (hipaajournal.com), and UNM said all critical electronic systems were back online by 27 October (bleepingcomputer.com). A new ransomware group, BYOD (also written Byod), claimed the attack on its leak site, but UNM has not confirmed the claim, the attack type, whether patient data was accessed, or any perpetrator. The FBI is assisting an active law enforcement investigation (securityweek.com), which is described as a criminal investigation (hipaajournal.com). A later write-up (fortra.com, 29 October) repeats that a ransomware group disrupted operations, with ambulances diverted, surgeries cancelled and medical students sent home, but adds no attribution, malware family or indicators.
Detalhes técnicos
- Employees reported messages on their computers late Monday morning claiming theft of student, employee and patient data (securityweek.com). Josephine Wolff (Tufts University) noted that displaying a message on computers is unusual compared with the long-running pattern of ransomware against hospitals (securityweek.com).
- UNM says its IT security teams contained the event, notified state and federal law enforcement, engaged external partners and activated an Emergency Operations Center (theregister.com). Some end-user devices were affected, but UNM says it kept the threat actor away from its core systems and servers (hipaajournal.com). It is unconfirmed that any ransomware payload was deployed (theregister.com). No initial access vector, malware or IOCs have been published; fortra.com likewise disclosed no malware family or technical indicators.
- BYOD claims it compromised 36,000 machines, both Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant and two Oracle databases (theregister.com, bleepingcomputer.com). hipaajournal.com reports the group claims 36,000 systems at the UNM main campus and UNM Health. All of this is unverified.
- Claimed stolen data includes Social Security numbers, HR and payroll records, Banner student records, hospital appointment data, student and employee PII, research data and internal emails (bleepingcomputer.com, infosecurity-magazine.com). The group also claims patient data and Cerner EHR rosters (hipaajournal.com). The group posted: "This is your entire network and infrastructure compromised, the entire university COMPLETELY" (infosecurity-magazine.com). VenariX reported the leak-site claim on X (infosecurity-magazine.com).
- BYOD said it would remove the post once the university opened communication, which likely means ransom negotiation. In a later post it offered free decryption keys for healthcare facilities and promised up to $2,500 per affected patient, while stating it would keep the stolen data (bleepingcomputer.com). hipaajournal.com adds that the group said it did not know the hospital ran systems supporting real-time patient care, and that the decryption keys were offered for the hospital sector only. It describes its activity as "pentesting" to hold data controllers accountable (bleepingcomputer.com).
- BYOD is newly formed. Its leak site listed six victims, three with leaked data, per bleepingcomputer.com, and 10 victims per the later hipaajournal.com. Its first named victim was Trump Mobile (data allegedly leaked for 3,615 customers), a claim that appears to have held up (theregister.com). A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be the same group (theregister.com).
- Academic impact: students at the School of Medicine, College of Pharmacy, College of Nursing and College of Population Health were told to leave campus. Classes there, including online ones, were cancelled on 26 and 27 October, and non-essential HSC staff were told to stay home. Central and branch campuses were not affected (infosecurity-magazine.com, theregister.com). fortra.com also reports medical students sent home and classes suspended. UNM HSC handles over one million patient visits a year (infosecurity-magazine.com).
Remediação
- No technical remediation guidance or IOCs have been published. External cybersecurity partners are assisting with remediation, law enforcement has been notified, and UNM has launched an investigation into the nature and scope of the unauthorized access (hipaajournal.com).
- UNM says recovery continues in phases and it will work with patients to reschedule missed appointments and procedures (infosecurity-magazine.com, theregister.com).
- UNM advises patients, staff and students to stay vigilant for unsolicited communications and phishing attempts (bleepingcomputer.com).
- Healthcare and education defenders should review Active Directory and Entra ID exposure and credential hygiene, and monitor for the data types the actor claims to hold (bleepingcomputer.com).
Relatos divergentes
- Scope of compromise: BYOD claims 36,000 machines, both AD forests and the whole Entra tenant (theregister.com, bleepingcomputer.com), and hipaajournal.com says it frames the 36,000 systems as covering the UNM main campus and UNM Health. UNM's assessment with external partners found only some end-user devices affected, with no penetration of core systems or servers (bleepingcomputer.com; repeated by hipaajournal.com, the most recent source on this point). Central and branch campuses were reported unaffected (infosecurity-magazine.com, theregister.com). The actor's claims remain unverified.
- Nature of the attack: BYOD is described as a ransomware group (theregister.com, infosecurity-magazine.com, bleepingcomputer.com, hipaajournal.com), and fortra.com, the most recent source, states flatly that a ransomware group attacked UNM HSC, but theregister.com notes it is unconfirmed that ransomware was deployed. securityweek.com, the earliest report, saw only on-screen messages claiming data theft and named no actor.
- Meaning of "BYOD": fortra.com describes the intrusion as linked to "BYOD (bring your own device)" exposure, as if it were an attack vector. The other sources (theregister.com, bleepingcomputer.com, infosecurity-magazine.com, hipaajournal.com) identify BYOD as the name of the claiming ransomware group, and no source confirms a bring-your-own-device vector. fortra.com itself discloses no attribution, malware or indicators, so this reading appears to be a misinterpretation of the group name.
- Data theft: The theft claims, from the on-screen messages and the leak site, have not been confirmed by UNM. hipaajournal.com notes UNM has not confirmed whether patient data was accessed.
- Operational status: securityweek.com reported phased resumption on 26 October. Later sources (infosecurity-magazine.com, theregister.com, bleepingcomputer.com) report hospitals reopened that night and clinics back to normal schedules on 27 October, with classes still cancelled for a second day. hipaajournal.com places critical systems back online in the early hours of 27 October.
- BYOD victim count: bleepingcomputer.com listed six victims, while hipaajournal.com, the more recent source, reports 10 on the leak site.
Linha do tempo
-
Ransomware attack on University of New Mexico Health Sciences Center diverts ambulances and cancels surgeries
ler a análise desta fonte ocultar
A ransomware group attacked the University of New Mexico Health Sciences Center (HSC), causing significant operational disruption. According to the report, ambulances were diverted, surgeries were cancelled, and medical students were sent home as classes were suspended. The intrusion is described as linked to BYOD (bring your own device) exposure. No threat actor attribution, malware family or technical indicators were disclosed in the article.
-
UNM Health diverts ambulances and cancels appointments after cyberattack claimed by new ransomware group Byod
ler a análise desta fonte ocultar
The University of New Mexico Health System (UNM Health) detected a cyberattack on October 26, 2026 that disrupted critical electronic systems across the University of New Mexico Health Sciences Center. Ambulance traffic was diverted from 12:30 to 2:30 p.m., appointments and outpatient surgeries were cancelled, and students were told to leave campus. Critical systems were back online in the early hours of October 27, and clinics resumed regular appointments that day. A new ransomware group, Byod, has claimed responsibility. UNM has not confirmed the nature of the attack or whether patient data was accessed, and the incident is under criminal investigation.
Technical Details
- Containment began at about 11 a.m. on October 26. Some end-user devices were affected, but UNM says it kept the threat actor away from its core systems and servers.
- Byod claims it compromised 36,000 systems at the UNM main campus and UNM Health. It also claims it exfiltrated patient, student and employee data, payroll information, internal emails and Cerner EHR rosters. These claims are unverified.
- The group later said it did not know the hospital ran systems supporting real-time patient care. It offered free decryption keys for the hospital sector only and said it will keep the stolen data. It also offered patients up to $2,500 each. Its leak site lists 10 victims.
- UNM Hospital is the only level 1 trauma center in New Mexico, so the disruption carried a serious patient-safety risk.
Remediation
- External cybersecurity partners are assisting with remediation, and law enforcement has been notified.
- UNM has launched an investigation into the nature and scope of the unauthorized access.
-
Byod ransomware claims attack on UNM Health, disrupting hospital admissions, ambulance intake and surgeries
ler a análise desta fonte ocultar
The University of New Mexico Health Sciences Center (UNM Health) disclosed a cyberattack on Monday that caused system outages. UNM limited new patient admissions, diverted ambulances, and suspended outpatient surgeries and appointments. UNM Hospital and Sandoval Regional Medical Center stayed open, and UNM later said all critical electronic systems were back online and clinics had resumed scheduled care. A new ransomware group, Byod, claimed the attack on its leak site and alleged theft of sensitive student, employee and patient data. UNM has not confirmed the claims and says the event affected some end-user devices but did not penetrate core systems or servers.
Technical Details
- UNM has not disclosed the type of attack. Byod claims it compromised 36,000 systems across the main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant and two Oracle databases (unverified threat actor claim).
- Claimed stolen data: Social Security numbers, HR, payroll and Banner student records, and hospital appointment data.
- Byod said it would remove the breach post once the university opened communication, which is likely a ransom negotiation. In a later post it offered free decryption keys for healthcare facilities and promised up to $2,500 per affected patient, while stating it would keep the stolen data.
- Byod is a new group with six listed victims, three of which have had data leaked. It describes its activity as "pentesting" to hold data controllers accountable.
- UNM's assessment, done with external partners, found only some end-user devices affected.
Remediation
- UNM advises patients, staff and students to stay vigilant for unsolicited communications and phishing attempts.
- Defenders in healthcare and education should review Active Directory and Entra ID exposure and credential hygiene, and monitor for the data types the actor claims to hold.
-
BYOD ransomware group claims attack on UNM Health Sciences Center; surgeries cancelled and ambulances diverted
ler a análise desta fonte ocultar
The University of New Mexico Health Sciences Center (UNM HSC) disclosed a cyber incident on Monday 26 October at 2:30pm MDT. It cancelled all appointments and scheduled surgeries for the day, and ambulances were diverted. Patients were told to use 911 for emergencies and to delay non-emergency care. Operations resumed in phases, all UNM Health hospitals had reopened by 10:27pm, and clinics were due to return to normal schedules on 27 October. The emerging ransomware group BYOD reportedly claimed the attack on its data leak site, according to cybersecurity intelligence firm VenariX on X. UNM has not confirmed the nature of the incident or any perpetrator.
Technical Details
- BYOD claims it compromised 36,000 machines and exfiltrated sensitive data. The claimed data includes student and employee PII, research data, student records and internal emails. This is unverified.
- The group posted: "This is your entire network and infrastructure compromised, the entire university COMPLETELY."
- Systems were brought back online in phases "as it was safe to do so".
- Students at the School of Medicine, College of Pharmacy, College of Nursing and College of Population Health were told to leave campus. Classes there, including online ones, were cancelled on 26 and 27 October, and non-essential staff were sent home. Central and branch campuses were not affected.
- UNM HSC handles over one million patient visits a year (about 900,000 outpatient and 100,000 emergency room visits) and had 2,670 students enrolled in 2025.
Remediation
No technical remediation guidance was published. UNM said it will work with patients to reschedule missed appointments and procedures.
-
University of New Mexico Health Sciences Center hit by cyberattack; BYOD group claims responsibility
ler a análise desta fonte ocultar
The University of New Mexico (UNM) Health Sciences Center (HSC), which includes the UNM Health clinical system, disclosed a "cybersecurity event" on 26 October 2026. UNM shut down systems, cancelled appointments and clinics, and diverted ambulances to facilities in Albuquerque and Santa Fe. Classes in the medicine, nursing and pharmacy faculties were cancelled for a second day, and hospital appointments and clinics resumed on 27 October, with nonessential HSC staff told to stay home. UNM has not disclosed the nature of the attack. The newly formed BYOD ransomware group claimed responsibility, but the claim is unverified and it is unconfirmed that any ransomware payload was deployed.
Technical Details
- UNM announced the incident at 14:30 local time on 26 October, dismissing all but critical and clinical staff.
- UNM says its IT security teams contained the event, notified state and federal law enforcement, engaged external partners and activated an Emergency Operations Center.
- BYOD claims it compromised 36,000 machines, both Active Directory forests, two Oracle databases, personal data of every student and employee, internal emails and data from other systems. None of this is verified.
- BYOD's first named victim was Trump Mobile (data allegedly leaked for 3,615 customers), a claim that appears to have held up. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two groups could be the same.
Remediation
UNM says recovery will continue in phases. No technical guidance or IOCs were published.
-
University of New Mexico Health System hit by cyber incident, diverts ambulances and closes 30+ clinics
ler a análise desta fonte ocultar
The University of New Mexico Health System (UNM Health) suffered a cybersecurity incident on Monday that forced it to divert ambulances, turn patients away from its main Albuquerque hospital and cancel appointments at more than 30 clinics. The network operates the state's only Level 1 trauma center, so New Mexico was left without an emergency department able to treat the most serious injuries. Presbyterian Healthcare Services and Lovelace Health System coordinated with UNM and took additional patients. Operations began resuming in phases later the same day. The nature and scope of the incident were not disclosed, and the FBI is assisting an active law enforcement investigation.
Technical Details
- Multiple employees reported that messages appeared across their computers late Monday morning claiming theft of student, employee and patient data. The claim is unverified.
- No threat actor, malware, initial access vector or ransom demand has been named. UNM declined to comment, citing the active investigation.
- Josephine Wolff (Tufts University) noted that breaching a system to display a message on computers is unusual, unlike the long-running pattern of ransomware against hospitals.
- The UNM Health Sciences Center also canceled classes.
Remediation
No remediation guidance was published. UNM said it was working to resolve the issue and restoring services in phases.