A ransomware group calling itself BYOD claimed responsibility for a cybersecurity incident at the University of New Mexico Health Sciences Center that forced the temporary diversion of ambulances and cancellation of outpatient care, then issued an unusual public apology and offered affected patients up to $2,500 each while stating it would retain any stolen data.
University of New Mexico Health Sciences Center information technology teams identified a cybersecurity threat around 11 a.m. on Oct. 26, 2026, and began containment efforts. From 12:30 to 2:30 p.m. that day, UNM Health temporarily diverted ambulance traffic to other hospitals in Albuquerque and Santa Fe. Outpatient surgeries and appointments across the system’s clinics were suspended for the rest of the day.
UNM Hospital serves as New Mexico’s only Level I trauma center, burn unit and children’s hospital. Classes and research activities at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health were canceled Monday and Tuesday. Critical electronic systems returned online by the afternoon of Oct. 27. Full clinical operations and academic activities resumed by Oct. 28.
In public updates, the Health Sciences Center said the incident affected some end-user devices but did not penetrate core systems or servers. Officials activated an Emergency Operations Center, notified state and federal law enforcement, and worked with external partners. “UNM did not make concessions with any group behind the threat,” the university stated.
BYOD listed the University of New Mexico on its Tor-based data-leak site and claimed it had compromised 36,000 machines across the main campus and hospital Active Directory forests. The group said it accessed two Oracle databases, student and employee personally identifiable information including Social Security numbers, internal emails, research data, electronic health record rosters, patient information and appointment data. An initial post stated, “This is your entire network and infrastructure compromised, the entire university COMPLETELY.”
On Oct. 27, BYOD posted an update offering free decryption keys for remaining locked devices in the hospital sector only. “We did not know that it was running machines related to assisting patients in real-time,” the group wrote. “We would keep it locked if it was appointments, patient information + research data only. We are still going to keep the data, but we will provide the decryption key for the hospital sector only.”
The same message continued: “To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data.”
Chris Ramirez, communications director for UNM Health, told reporters the university stood by its assessment of limited impact on end-user devices. “The information we’ve put out, as we’ve stated it, is factual and accurate despite what other groups may be claiming,” Ramirez said in an email. At a news conference he added that a thorough forensic analysis by the FBI is underway and that the health system is “waiting to find out” whether patient data was compromised.
In an Oct. 28 update, UNM Health Sciences Center explicitly warned the public against engaging with anyone claiming responsibility for the incident. “Those responsible may attempt to exploit individuals through additional scams, including false offers of payments or compensation,” the statement said. Patients, students, employees and community members were advised not to respond, click links, open attachments or provide personal information, and to report any such contact to the FBI’s Internet Crime Complaint Center.
BYOD is a relatively new extortion group that first appeared publicly in early October 2026. Tracking sites have associated it with a small number of prior claims, including listings involving T-Mobile and Trump Mobile. The group has described its activity as a form of “pentesting” aimed at exposing poor security practices. University officials have not confirmed the group’s claims about the scale of access or data theft, and no formal breach notifications have been issued as of late October.
The FBI is leading the criminal investigation. UNM Health continues to work with patients to reschedule disrupted appointments and procedures. Some employees were still being instructed not to power on certain devices while the forensic review proceeded.
