What the UNM Health Cyberattack Does and Doesn’t Tell Hospital Security Teams

On Monday, October 26, 2026, the University of New Mexico Health Sciences Center (UNM HSC) identified a cybersecurity threat around 11 a.m., diverted ambulances from 12:30 to 2:30 p.m., and suspended outpatient surgeries and appointments for the rest of the day as a precaution. About 27 hours after the incident was identified, on Tuesday, October 27, UNM reported critical systems back online, all of its hospitals fully open, ambulance traffic back to normal, and clinics back on regular schedules, according to UNM HSC’s incident updates. UNM HSC says the attack affected some end-user devices but did not penetrate core systems or servers. A new ransomware group, Byod, claims much broader access. At the time of this publication, that claim is unverified, and UNM has not disclosed how the attacker got in.

The most useful lesson from the UNM Health cyberattack for hospital security teams sits upstream of the containment call: knowing which devices an attacker could reach and use, and closing those paths before anyone has to decide what to shut off.

UNM Health Cyberattack: Key Facts

Organization	University of New Mexico Health Sciences Center (UNM HSC), including UNM Hospital, New Mexico’s only Level I trauma center
Detected	About 11 a.m. MT, Monday, October 26, 2026
Patient care impact	Ambulances diverted 12:30 to 2:30 p.m.; outpatient surgeries and appointments suspended for the rest of the day
Restoration	Phased restoration from 2:30 p.m. Monday; critical systems back online by 2:02 p.m. Tuesday, October 27, about 27 hours after containment began
UNM’s assessment	Some end-user devices affected; core systems and servers not penetrated
Claimed by	Byod (also written BYOD), a new ransomware group; its claims are unverified
Attack vector	Not disclosed
Status	Hospitals, ambulance traffic, and clinics operating normally; incident remains under criminal investigation

Key facts as of October 29, 2026. Sources: UNM HSC, BleepingComputer.

What Happened in the UNM Health Cyberattack?

UNM HSC says IT security teams worked with external partners and notified state and federal law enforcement, and systems came back “in phases as it was safe to do so.” UNM Hospital leadership also activated an Emergency Operations Center to coordinate the response.

When (local time)	What UNM HSC reported
Mon, Oct 26, about 11 a.m.	Threat identified, containment begins
Mon, 12:30 to 2:30 p.m.	New patient intake limited, ambulances diverted
Mon, rest of day	Outpatient surgeries and appointments suspended
Mon, 2:30 p.m.	Systems begin returning in phases
Mon, 10:27 p.m. update	All UNM Hospital and Sandoval Regional Medical Center locations open
Tue, Oct 27	Classes canceled at four HSC schools, nonessential staff home
Tue, 2:02 p.m. update	Critical systems restored, ambulance traffic normal, clinics resumed
Wed, Oct 28	HSC academic and research programs set to resume normal operations

Source: UNM HSC incident updates, October 26 and 27, 2026.

UNM Health handles more than 1 million patient visits a year, and UNM Hospital houses New Mexico’s only Level I trauma center, according to BleepingComputer. When a hospital like that diverts ambulances, neighbors absorb the load; on Monday, those were health systems in Albuquerque and Santa Fe. In a 2023 JAMA Network Open study of a month-long ransomware attack on a San Diego health system, ambulance arrivals at two neighboring emergency departments rose 35.2%, and the authors said such attacks should be considered a “regional disaster.”

Was UNM Health Hit by Ransomware? What We Know and What We Don’t

UNM HSC’s assessment is specific: the event “affected some end-user devices but did not penetrate core systems or servers.” UNM has not named the attack type or the initial access vector, and says the criminal investigation limits what it can share. KOB 4 reported that an image of a red skull replaced employees’ screens, which is consistent with impact on end-user devices. KRQE reported that internal communications told employees to shut off and unplug their computers.

BleepingComputer reports that the new ransomware group Byod claimed the attack, alleging access to 36,000 systems, Active Directory forests, the Microsoft Entra tenant, and two Oracle databases. The group also claims it took Social Security numbers, HR and payroll records, student records, research data, and Cerner EHR rosters. Byod listed six victims on its leak site at the time, and it later said it would give healthcare facilities free decryption keys. Separately, KOB 4 obtained a recording of an automated message, played on hospital workers’ computers, that demanded contact and claimed the attackers held student and employee data, including Social Security numbers. Those claims are unverified. The access claims conflict with UNM’s assessment. On October 28, UNM urged skepticism of Byod’s claims, said it had made no concessions to the attackers, and said it could not confirm whether patient data was compromised until an FBI forensic analysis is complete, according to the Albuquerque Journal.

How Does the UNM Health Attack Compare to Other Hospital Cyberattacks?

Speed is what stands out. By comparison, the University of Mississippi Medical Center (UMMC), which operates that state’s only Level I trauma center, was hit by ransomware on February 19, 2026. It closed its roughly three dozen clinics statewide and took other systems offline, including email, for testing. Its clinics did not reopen until March 2.

This is also not UNM Health’s first incident. In 2021, an unauthorized party accessed UNM Health’s network on May 2 and was not discovered until June 4. The breach affected up to 637,252 patients, according to its report to the HHS Office for Civil Rights, and UNM Health said its medical record systems were not affected, HIPAA Journal reported.

Taken together, these cases suggest the harder problem sits upstream of containment: how far an attacker can reach, and for how long, before anyone has to decide what to shut off.

Why Faster Isolation Is an Incomplete Lesson

A common reading of incidents like this is that the lesson is device visibility and faster isolation: discover every device, baseline its traffic, and quarantine on deviation. Containment speed matters, but that reading fits UNM’s disclosed facts less well than it first appears.

By the published timeline, the response was already quick: about three and a half hours from the start of containment to phased restoration, with all hospitals reported open that night.

UNM’s disclosure points at end-user devices. Quarantine examples built around imaging systems, such as isolating MRI machines, describe a different kind of incident. Nothing UNM has disclosed as of October 28 involves medical devices.

Inventory and a traffic baseline, on their own, produce a list without a ranking. A hospital network can hold tens of thousands of connected devices, and a map of all of them says little about which ones an attacker could use to move from a compromised laptop toward clinical systems.

Policy learned from live traffic also starts from whatever already flows, including connections nobody approved. Observed behavior is a required input. Risk context and clinical review decide which flows should survive.

The vector is also undisclosed. Prescribing product features for an attack path nobody has published is premature, and that applies to us too. What follows reduces exposure regardless of how an attacker gets in.

How Can Hospitals Reduce Exposure Before the Next Incident?

Inventory that includes end-user devices. Workstations share networks with Internet of Things (IoT), operational technology (OT), and Internet of Medical Things (IoMT) devices and all of their services and applications. Look for one inventory that shows a compromised laptop and the clinical devices it communicates with in the same view. Asimily builds an agentless, continuously updated inventory of IoT, OT, IoMT, and IT assets (including applications, services, AI workflows, and more) from network traffic and can correlate data from Active Directory, Microsoft Intune, and endpoint detection and response (EDR) tools such as CrowdStrike Falcon and Palo Alto Networks Cortex.

Prioritization by real exploitability. A ranked queue is more useful than a complete list. Asimily’s ATT&CK Analysis evaluates whether a vulnerability is actually exploitable on a specific device, factoring in configuration, network exposure, and compensating controls instead of Common Vulnerability Scoring System (CVSS) scores alone.

Mitigation that doesn’t wait for a patch. Many clinical and IoT devices can’t be patched on a security team’s schedule. Asimily provides targeted recommendations, such as restricting a specific service, that help close an exposure without a patch.

Segmentation you can deploy. Segmentation reduces exposure only once it’s enforced without breaking clinical workflows. Asimily’s Segmentation Orchestration generates policy from observed device behavior, prioritized by device risk, and pushes it to your existing network access control (NAC) platforms, such as Aruba, Cisco ISE, Extreme, and others. Policy Simulation runs a proposed policy against real network traffic first, so clinical engineering sees the impact before anything goes live.

Evidence ready for the first hour. The first-hour question is scope: were only end-user devices affected? Asimily’s Threat and Response capabilities flag anomalous behavior with its MITRE ATT&CK tactic, show which devices and services a device accessed before, during, and after an event, and can trigger packet capture automatically when a policy is violated, to later share with trained incident responders.

What Should Hospital Security Teams Do This Week?

These steps follow CISA’s #StopRansomware guidance to segment networks and restrict lateral movement from initially infected devices.

1. Confirm your inventory includes end-user devices alongside IoT, OT, and IoMT, and shows what each communicates with.
2. Rank your highest-risk assets and devices by exploitability rather than CVSS alone, and note which have a mitigation that needs no patch.
3. Map which clinical systems a compromised workstation could reach today, and decide which paths should exist.
4. Simulate every segmentation change against real traffic before enforcement, with clinical engineering involved.
5. Pre-stage packet capture triggers so scoping evidence exists when you need it.
6. Review diversion plans with neighboring health systems.

Moving Forward

UNM’s team had critical systems back online within about 27 hours of starting containment, and the investigation is ongoing. For every other hospital, the practical test is this: if a workstation were compromised tomorrow, how many paths lead from it to the systems that keep operations running, and how many of these paths can be closed?

We will update this post as UNM HSC shares findings from its investigation.

UNM Health Cyberattack: Frequently Asked Questions

Is UNM Health Back Online After the Cyberattack?

Yes. In its 2:02 p.m. update on Tuesday, October 27, 2026, UNM HSC said critical electronic systems were back online, all UNM Health hospitals were fully open, ambulance traffic had returned to normal, and clinics had resumed regularly scheduled appointments and procedures. HSC academic and research programs were set to resume on Wednesday, October 28.

When Did the UNM Health Cyberattack Happen?

UNM HSC security teams identified a threat and began containment around 11 a.m. on Monday, October 26, 2026. UNM Health diverted ambulances from 12:30 to 2:30 p.m. that day and reported critical systems back online at 2:02 p.m. on Tuesday, October 27.

Was UNM Health Hit by Ransomware?

UNM has not named the attack type. A new ransomware group called Byod claimed the attack on its leak site, and KOB 4 reported that an automated extortion message played on hospital workers’ computers. UNM has not confirmed either claim.

Were UNM Health’s Core Systems or Servers Compromised?

UNM HSC says its assessment found the event affected some end-user devices but did not penetrate core systems or servers. Byod claims access to 36,000 systems, Active Directory, and Microsoft Entra, but that claim is unverified.

Was Patient Data Stolen in the UNM Health Cyberattack?

Byod claims it took patient, student, employee, and research data. As of October 28, 2026, UNM had not confirmed any data theft and said it would not know whether patient data was compromised until the FBI’s forensic analysis is complete. UNM also warned patients and employees not to engage with anyone claiming responsibility for the attack.

How Long Were UNM Health’s Systems Down?

Phased restoration began at 2:30 p.m. Monday, about three and a half hours after containment started. All UNM Health hospitals were open that night, and clinics resumed regular appointments Tuesday. UNM reported critical systems back online at 2:02 p.m. Tuesday, about 27 hours after containment began. By comparison, the University of Mississippi Medical Center’s clinics stayed closed for more than a week after a February 2026 ransomware attack.

What Should Other Hospitals Do After the UNM Health Attack?

Map which clinical systems a compromised workstation could reach, rank devices by real exploitability, simulate segmentation changes against real traffic before enforcement, and pre-stage evidence collection so the team can confirm scope in the first hour.

Sources

• UNM HSC Newsroom, “Update on Cybersecurity Event at UNM Health Sciences Center,” October 26 to 27, 2026
• BleepingComputer, “UNM Health ransomware attack disrupts patient care, surgeries,” October 27, 2026
• KOB 4, “UNM Health classes cancelled again due to cyberattack”
• KRQE, “UNM Health impacted by cyberattack,” October 26, 2026
• Albuquerque Journal, “UNM Health has not made concessions to hackers after cyberattack, officials say,” October 28, 2026
• BankInfoSecurity, “Cyberattack Disrupts New Mexico’s Only Trauma Center,” October 27, 2026
• Help Net Security, “Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack,” October 27, 2026
• HIPAA Journal, “University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack”
• JAMA Network Open, regional effects of a health system ransomware attack, 2023
• TechTarget, “UMMC reopens clinics following ransomware attack,” 2026
• BankInfoSecurity, “Mississippi Medical Center Clinics Still Closed After Attack,” February 24, 2026
• HIPAA Journal, “UNM Health Data Breach Affects More than 637,000 Patients,” 2021
• CISA, #StopRansomware: Medusa Ransomware advisory (AA25-071A)