Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack
University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a substantial data breach.
Hospitals diverted ambulances and canceled appointments
The University of New Mexico, located in Albuquerque, New Mexico, is a public research university. Its Health Sciences Center encompasses its clinical, research and education initiatives. The clinical branch includes the University of New Mexico Hospital – the state’s largest teaching hospital – and associated medical centers. The Health System operates New Mexico’s only Level 1 trauma center.
On 2:30 p.m. MDT Monday, the University’s HSC announced it was experiencing a cybersecurity issue, was diverting ambulance traffic to other hospitals, and had canceled all appointments at all clinics that day.
In an update published a few hours later, the HSC stated that its IT security teams were working on containing the event, and that external partners were called in to assist with the investigation. State and federal law enforcement had been notified, it added, and UNM Health is resuming operations and bringing systems back online in phases.
A final update later that same day said all UNM Health hospitals were open and clinics would resume appointments and procedures scheduled for Tuesday, October 27, 2026. Classes scheduled for Tuesday at the University’s medicine, nursing, pharmacy and other schools and colleges have been canceled.
“We recognize this event may have impacted patients, employees and students, and we appreciate their patience as our teams respond. We understand there are many questions. Because this remains an active law enforcement investigation, we are limited in what we can share at this time,” the HSC added.
“We are grateful to the health systems in Albuquerque and Santa Fe that worked with us to ensure patients had a safe place to receive care.”
Attackers claim to have stolen student and employee data
According to The Daily Lobo, the student-run newspaper of the University of New Mexico, the hackers reportedly played a (synthetic) voice message on hospital workers’ computers during the attack.
In the message, they claimed to have stolen “student and employees’ data, personal identifiable information and SSNs, private documents, emails and much more,” and urged administrators to get in touch via an encrypted messaging service (presumably to negotiate a ransom payment not to disclose the stolen data).
According to the message sent out by the administrators to healthcare workers, the network breach was detected Monday, around 11:30 a.m., and some 40 minutes later healthcare staff were asked to shut down and unplug computer systems and turn off the Wi-Fi on mobile devices.
The attack was claimed by BYOD, a cyber extortion outfit that advertises alleged intrusions on a Tor leak site and threatens to disclose stolen information unless unless it is paid. It’s currently unclear if they also used ransomware to encrypt data on victims’ systems.
On its leak site, the group claimed to have compromised 36,000 machines, both on the UNM main campus and hospital environments, and compromised “two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters.” Their claims are still unconfirmed.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
