INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

UNM Health suffers ransomware attack disrupting patient care services

| 2026-10-27 22:07 CRITICAL LOW RANSOMWARE & EXTORTION DATA BREACH DDOS & DISRUPTION
JSON
Executive Summary
AI-generated
A cyberattack on the University of New Mexico Health Sciences Center occurred on October 27, 2026. The attack was carried out by a new ransomware group called Byod, which claimed to have compromised 36,000 systems across UNM's main campus and hospital environments. This resulted in system outages, disruptions to patient care and academic activities, with the university temporarily limiting new patient admissions, diverting ambulances, and suspending outpatient surgeries and appointments. The attack affected over 1 million patients annually, who were exposed to potential data breaches including Social Security numbers, HR payroll records, student information, internal emails, research data, hospital appointment data, and Cerner EHR rosters. Byod ransomware demanded a payment in exchange for not releasing the stolen data, promising to pay up to $2,500 for every patient affected by the cyberattack; however, it also stated that it would keep all the stolen data.
Technical Mitigations AI-generated
• Patch Microsoft Entra tenant to prevent exploitation of vulnerabilities. • Implement Oracle database security patches for the two compromised databases. • Use a reputable antivirus solution with real-time protection and regular updates.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
MX
healthhealth educationeducation
Incident Timeline
‎2026/10/27
Threat actors used Byod ransomware to target UNM Health Sciences, resulting in the disruption of patient care and surgeries.
tactic Ransomware
In a new post today, Byod ransomware said it would provide free keys that decrypt locked systems at healthcare facilities.
organisation UNM
In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27.
organisation UNM Hospital
In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27.
organisation Sandoval Regional Medical Center
In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27.
‎2026/10/27
Threat actors claiming to be Byod ransomware group claimed access to sensitive data of patients, staff and students at UNM Health Sciences Center.
organisation UNM Health
UNM Health ransomware attack disrupts patient care, surgeries.
organisation Byod
Byod ransomware claims the attack UNM did not disclose the type of cyberattack it suffered, but BleepingComputer found that a new ransomware group called Byod had claimed the attack.
organisation BleepingComputer
Byod ransomware claims the attack UNM did not disclose the type of cyberattack it suffered, but BleepingComputer found that a new ransomware group called Byod had claimed the attack.
organisation Banner
HR, payroll, and Banner student records Internal emails Research data Hospital appointment data Patient information Cerner EHR rosters In an attempt to force a payment, Byod ransomware said it would take down the breach post after the university initiated communication, likely for negotiating a ransom.
organisation Hospital
HR, payroll, and Banner student records Internal emails Research data Hospital appointment data Patient information Cerner EHR rosters In an attempt to force a payment, Byod ransomware said it would take down the breach post after the university initiated communication, likely for negotiating a ransom.
organisation Active Directory
In a post on their data leak site, the threat actor said it had compromised 36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases.
organisation Group Policy
In a post on their data leak site, the threat actor said it had compromised 36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases.
organisation Microsoft
In a post on their data leak site, the threat actor said it had compromised 36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases.
organisation COMPLETELY
"This is your entire network and infrastructure compromised, the entire university COMPLETELY," the threat actor said.
organisation Social Security
They claim access to student and employee personal data, including: Social Security numbers (SSNs)
organisation UNM Health Sciences
BleepingComputer has reached out to UNM Health Sciences with a request for comment about these data theft allegations, but we have not received a response.
organisation FAQ
On its FAQ page, the threat group claims it is doing “pentesting” to expose vulnerabilities and hold data controllers accountable for breaches.
organisation UNM Health Sciences Center
"  "Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers," UNM Health Sciences Center notes.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
financial $2,500 actor
Caption Furthermore, the threat actor promised to pay up to $2,500 for every patient affected by the cyberattack.
Tactical Metrics
Metrics
financial
2,500
Financial Impact / Stolen Funds
Caption Furthermore, the threat actor promised to pay up to $2,500 for every patient affected by the cyberattack.
Intelligence Sources
BleepingComputer 2026-10-27