Summary
- UNM Health Sciences Centre suffered a cyberattack on Monday, 26 October 2026, triggering an Emergency Operations Centre activation and immediate system shutdowns.
- Ambulances were diverted to facilities in Albuquerque and Santa Fe; patients were urged to avoid HSC premises for most of the first day.
- A group calling itself BYOD claimed responsibility, alleging it compromised 36,000 machines, two Active Directory forests, two Oracle databases, and personal data for all students and staff — claims that remain unverified.
- The university has not confirmed the nature of the attack, and unverified threat-actor claims should not be treated as authoritative.
- Hospital appointments and clinics resumed on day two, though non-essential staff were asked to stay home and classes in health sciences faculties remained cancelled.
What happened
The University of New Mexico announced on Monday afternoon that its Health Sciences Centre had experienced a cybersecurity event, confirmed in a formal statement released at 1430 local time. In the hours that followed, the university cancelled remaining clinics and classes, sent home all but critical and clinical staff, and asked patients not to attend HSC facilities. Ambulances were diverted to healthcare facilities in Albuquerque and Santa Fe while IT security teams worked to contain the incident.
Operational impact
By day two, hospital appointments and clinics had returned to something resembling normal operations, though non-essential HSC staff were asked to work from home. Classes across the medicine, nursing, and pharmacy faculties were cancelled for a second consecutive day. The university activated an Emergency Operations Centre to coordinate response efforts and communicate with employees, students, and frontline clinical providers. State and federal law enforcement were notified, and external partners were engaged to assist with the investigation.
A group claims responsibility — treat with caution
A newly formed group calling itself BYOD claimed responsibility for the attack on Monday afternoon. The group alleged it had compromised 36,000 machines, both Active Directory forests, two Oracle databases, and the personal data of every student and employee, along with internal emails and data from other systems. These claims have not been verified by the university or independent investigators, and the university has declined to comment on the nature of the attack beyond its public statement. As a general principle, threat-actor self-reporting is not reliable — groups routinely exaggerate scope, claim attacks they did not conduct, or conflate separate incidents.
Who is BYOD?
BYOD is a recently emerged ransomware group with limited public track record. Its first named victim was Trump Mobile, a US smartphone business associated with the Trump brand, from which it allegedly leaked data belonging to 3,615 customers. A separate group, EndZone, claimed a similar breach of the same organisation a week prior, and some researchers have suggested the two groups may be connected. Separately, Trump Mobile was found in May to have been leaking customer data through a poorly secured website. Whether BYOD’s claims about UNM will prove out as their Trump Mobile claims appear to have done is not yet known.
What the university has and hasn’t said
UNM’s public statement confirmed the incident, the activation of an Emergency Operations Centre, and engagement with law enforcement and external forensic partners. A spokesperson directed additional press questions back to that statement without elaboration. The university has not confirmed whether ransomware was deployed, whether data was exfiltrated, or what the likely recovery timeline looks like. That absence of information is itself operationally relevant for security leaders watching the situation.
Why it matters
This incident illustrates how a single cyberattack against a health sciences centre can cascade rapidly into patient safety decisions — ambulance diversions, cancelled clinics, and multi-day operational disruption — before the nature of the attack is even publicly understood. For CISOs in healthcare and higher education, the UNM event is a reminder that Active Directory compromise and multi-forest exposure represent some of the highest-impact failure modes available to an adversary. The unverified claim of 36,000 compromised endpoints and dual-forest access, if accurate in any part, would suggest a significant dwell time or a fast-moving intrusion against an environment with insufficient lateral movement controls. The speed with which a new and largely unknown threat group named the university as a victim also points to the reputational and operational pressure that now accompanies any major incident, regardless of whether attribution is accurate.
What to do now
- Review segmentation between clinical, administrative, and academic network environments to limit lateral movement in the event of an initial compromise.
- Assess Active Directory forest trust relationships and ensure monitoring is in place for anomalous cross-forest authentication activity.
- Confirm that ambulance diversion and clinic cancellation procedures are included in your organisation’s cyber incident response playbooks, particularly for health sector entities.
- Engage state and federal law enforcement contacts in advance of an incident, so notification pathways are established before they are needed.
- Establish a process for evaluating unverified threat-actor claims during an active incident, including criteria for when and how to communicate publicly about those claims.
