A cyberattack claimed by a ransomware gang on a New Mexico teaching hospital disrupted surgeries

Outpatient surgeries and clinic appointments across the University of New Mexico’s health system stopped on Monday, October 26, 2026, after a cyberattack hit the University of New Mexico Health Sciences Center in Albuquerque. Ambulances were diverted to other hospitals for roughly two hours, and a ransomware gang calling itself Byod claimed responsibility that evening. The university has not said whether ransomware was actually involved.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

The Health Sciences Center is the umbrella for UNM Hospital, Sandoval Regional Medical Center, more than 30 clinics around the state and four academic schools. That breadth is why one intrusion reached operating schedules, lecture halls and research labs in the same afternoon, and why the recovery was measured in days rather than hours.

Monday’s shutdown at UNM Hospital and its clinics

According to the Health Sciences Center’s own running update, IT security teams began containment at about 11 a.m. on Monday. From 12:30 to 2:30 p.m. UNM Health diverted ambulance traffic to other health systems in the area, limited new patient admissions, and suspended outpatient surgeries and appointments for the rest of the day. Systems began returning in phases at 2:30 p.m. Care teams said they would work with patients to reschedule the procedures that were lost.

Help Net Security, in its account of the incident, put the detection of the network breach at about 11:30 a.m. and reported that staff were told roughly 40 minutes later to shut down and unplug their systems. That instruction explains how a problem that first showed up on end-user devices turned into a hospital-wide pause.

The Albuquerque Journal reported that all appointments and outpatient surgeries at the 30-plus UNM Health clinics statewide were canceled Monday. U.S. Sen. Martin Heinrich said on X that afternoon that he was “closely monitoring” the situation and working to see that available federal resources were deployed. The hospital itself said the matter was an active law enforcement investigation and that it was limited in what it could share.

Byod claims 36,000 systems, Active Directory included

BleepingComputer’s Bill Toulas found that Byod, a new group listing six victims on its leak site and having published data for three, claimed the attack. The group says it compromised 36,000 systems, including Active Directory, Group Policy, the Microsoft Entra tenant and two Oracle databases, and that it holds Social Security numbers, payroll and student records, research data, patient information and Cerner records rosters.

None of that is verified. It also conflicts with the university’s own assessment. Byod later said it would hand free decryption keys to healthcare facilities and pay up to $2,500 per affected patient, while still keeping the stolen data, a pair of statements BleepingComputer read as an attempt to open ransom talks.

The Record, covering the same claim, noted that the group emerged only last month and that little is known about it, and that a claim of responsibility is not confirmation. Help Net Security went further, writing that it is unclear whether Byod used ransomware to encrypt anything at all or only stole data and threatened to leak it. That is the reason the university’s silence on the word “ransomware” matters.

The comparison most useful to patients is downtime. The Albuquerque Journal noted that the University of Mississippi Medical Center suffered what it called a similar ransomware attack in February 2026 that closed its clinics for more than a week, with normal operations returning after nine days, and that a Comparitech report puts average healthcare downtime after a cyberattack at 17 days. UNM’s clinics were largely running again within a day, which is fast by that yardstick.

UNM’s account: end-user devices, no concessions

The university’s initial assessment was that the event affected some end-user devices but did not penetrate core systems or servers. It also said it made no concessions to any group behind the threat, notified state and federal law enforcement, and activated its Emergency Operations Center. The same update told the public not to engage with anyone claiming responsibility, not to click links or open attachments from unknown senders, and to report contact to the FBI through the Internet Crime Complaint Center or 1-800-CALL-FBI.

Recovery came in steps. By 2:02 p.m. Tuesday critical systems were back online, ambulance operations had returned to normal and clinics resumed scheduled appointments and procedures, though classes at the School of Medicine and the Colleges of Nursing, Pharmacy and Population Health stayed canceled and nonessential employees stayed home. Classes and research resumed Wednesday, and UNM described clinical operations at all of its facilities as fully functional as of 12:39 p.m. that day.

The open question is what, if anything, left the building. UNM says core servers were not penetrated, Byod says it reached the identity systems that sit at the center of a Windows network, and the university had not answered BleepingComputer’s request for comment on the data theft claims when that report was published. Until the investigation produces a finding, patients whose Monday surgeries were postponed have no way to know whose version of events covers their records.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.