Incident: A cyberattack disrupted UNM Health operations on October 26, forcing ambulance diversions and appointment cancellations.
Attribution: Byod claimed responsibility, but UNM has not confirmed the ransomware group’s allegations.
Recovery: UNM restored critical systems by October 27 and reported that the incident affected some end-user devices, not core servers.
Enterprise response: Healthcare IT teams should investigate affected endpoints, contain confirmed threats, preserve evidence, and validate recovery before restoring access.
On October 26, 2026, a cybersecurity incident at UNM Health disrupted patient admissions, ambulance routing, outpatient surgeries, and clinical appointments. The ransomware group Byod claimed responsibility, although UNM has not confirmed the nature of the attack. The cybersecurity incident affected the University of New Mexico Health Sciences Center, prompting emergency containment measures across its healthcare operations.
Although UNM restored critical electronic systems and resumed normal clinical operations on October 27, the disruption highlighted how cybersecurity incidents can interrupt essential healthcare services. A ransomware group named Byod claimed responsibility, but UNM has not publicly confirmed the group’s allegations or identified the attack method.
The incident raises important questions about endpoint security, operational continuity, and safe recovery in healthcare environments.
What happened during the UNM Health cyberattack?
On October 26, UNM Health Sciences Center experienced a cybersecurity incident that disrupted clinical and academic operations.
The incident affected UNM Hospital and Sandoval Regional Medical Center’s operations, along with outpatient facilities. UNM temporarily redirected ambulances to neighboring hospitals and suspended scheduled outpatient surgeries and appointments.
The disruption carried particular significance because UNM Hospital operates New Mexico’s only Level I trauma center.
Timeline of the UNM Health cyberattack
October 26, approximately 11 a.m.: UNM security teams began containing the cybersecurity incident and protecting critical infrastructure.
October 26, early afternoon: UNM diverted ambulances for approximately two hours and canceled outpatient appointments and surgeries.
October 26, approximately 2:30 p.m.: IT teams began restoring affected systems and gradually resuming operations.
October 27: UNM confirmed that critical electronic systems were operational, hospitals were fully open, and ambulance traffic had returned to normal.
October 28: UNM reported that clinical, academic, and research activities had resumed and warned against engaging with groups claiming responsibility.
UNM also notified state and federal law enforcement. The incident remains under criminal investigation.
What do we know about the attack?
The technical details of the UNM Health ransomware attack remain limited. UNM confirmed that some end-user devices were affected but reported no penetration of core systems or servers.
Several details remain undisclosed:
Initial access: UNM has not disclosed how the incident originated.
Malware: The organization has not confirmed the ransomware family or malicious tools involved.
Attack techniques: UNM has not disclosed evidence of lateral movement, privilege escalation, or data exfiltration.
Compromise scope: The full extent of affected endpoints remains unclear.
Cybersecurity essentials for any organization
Explore essential cybersecurity practices to protect organizations against threats.
What did the Byod ransomware group claim?
According to BleepingComputer, Byod claimed responsibility for the incident through its data leak website.
The group alleged:
System compromise: Access to approximately 36,000 university and hospital systems.
Infrastructure access: Compromise of identity infrastructure and databases.
Sensitive data: Access to student, employee, and patient information.
Decryption keys: Boyd offered free decryption keys, but UNM has not confirmed encryption.
These claims remain unverified. UNM has not confirmed the alleged infrastructure compromise, data theft, or use of decryption keys.
Why does distinguishing confirmed findings from attacker claims matter?
Ransomware groups’ allegations do not independently establish the extent or consequences of an attack.
Security teams must distinguish between:
Claimed access and confirmed compromise: Attacker statements do not prove unauthorized system access.
Data access and exfiltration: Alleged access does not confirm data theft.
Ransomware claims and encryption: Attribution claims do not establish successful file encryption.
Suspected and verified techniques: Investigators need forensic evidence to confirm attack methods.
These distinctions help healthcare IT teams assess actual exposure and prioritize incident response based on verified findings.
Why does the UNM Health incident matter to healthcare IT?
Healthcare organizations depend on interconnected endpoints, clinical applications, identity services, and administrative systems to maintain patient care.
Even a temporary disruption can force hospitals to modify clinical workflows, redirect emergency services, or postpone procedures.
The UNM incident illustrates several operational risks:
Operational area
Potential security concern
IT response priority
Clinical workstations
Suspicious endpoint activity
Investigate and contain affected devices
Patient admissions
Interrupted access to administrative workflows
Maintain alternative intake procedures
Emergency services
Ambulance diversions and care delays
Coordinate clinical continuity plans
Identity infrastructure
Potential credential misuse
Review authentication activity and access
System restoration
Residual malicious activity
Validate systems before reconnecting
These risks represent general healthcare incident-response considerations, not confirmed technical findings about UNM’s environment.
Why endpoint containment matters
Endpoints can provide attackers with access to sensitive systems, credentials, and connected infrastructure.
When security teams identify malicious activity, rapid containment can reduce opportunities for additional execution or unauthorized network communication.
However, isolation decisions require clinical coordination. Disconnecting a workstation that supports active patient care may introduce operational risks.
Healthcare IT teams should therefore prioritize confirmed threats while coordinating containment with clinical staff and maintaining essential services.
How should healthcare organizations respond to ransomware incidents?
An effective response must address immediate threats without overlooking operational continuity. Healthcare IT teams should follow a structured approach:
1. Identify potentially affected endpoints
Review endpoint alerts, suspicious processes, authentication events, and available security telemetry. Determine which devices require investigation and distinguish confirmed malicious activity from unusual but legitimate clinical workflows.
2. Contain confirmed threats
Isolate affected endpoints when necessary to restrict further communication. Terminate malicious processes where appropriate, while preserving forensic evidence and coordinating actions involving critical clinical systems.
3. Investigate the extent of compromise
Examine process execution, suspicious files, user activity, and available network evidence. Determine whether attackers accessed additional systems or credentials. Avoid assuming that every connected device suffered compromise.
4. Validate remediation and recovery
Remove confirmed malicious artifacts, address identified security weaknesses, and verify endpoint integrity. Before reconnecting systems, confirm that security controls function correctly and that clinical applications remain operational. Recovery should follow evidence-based verification rather than relying solely on restored system availability.
How can Hexnode XDR support healthcare endpoint containment?
Hexnode XDR provides investigation and response capabilities that can support administrator-led threat containment on supported endpoints.
During a suspected ransomware incident, security teams can use its capabilities to investigate suspicious activity and take targeted remediation actions.
Process investigation: Examine available command-line details, process metadata, and parent-child process relationships associated with detected threats.
Endpoint isolation: Restrict network communication from an affected endpoint while maintaining its connection to the Hexnode XDR console.
Process termination: Stop selected malicious processes or associated process trees following investigation.
File quarantine: Move suspicious files into a restricted, encrypted location to prevent further access or execution.
Incident tracking: Assign incidents, record investigation findings, and export relevant threat information for further analysis.
These capabilities help administrators investigate and contain supported endpoint threats while coordinating broader incident-response activities.
However, Hexnode XDR does not independently establish the attack method behind the UNM incident, guarantee detection of the Byod ransomware group, or replace forensic investigation and validated recovery procedures.
Featured resource
Cybersecurity kit
Download essential cybersecurity guides, checklists, frameworks, and templates to strengthen your organization's overall security posture.
UNM confirmed a cybersecurity incident that disrupted healthcare operations. Although the Byod ransomware group claimed responsibility, UNM has not publicly verified the group’s allegations or disclosed the specific attack method.
Did the UNM Health cyberattack compromise patient information?
Byod claimed access to patient and other sensitive information. However, UNM has not confirmed those data theft allegations, and the publicly available findings do not establish the extent of any information exposure.
How can healthcare organizations contain ransomware threats?
Healthcare IT teams can investigate suspicious endpoint activity, isolate confirmed threats, terminate malicious processes, and preserve forensic evidence. They should coordinate containment with clinical operations and validate remediation before restoring affected systems.
Conclusion
The UNM Health cyberattack highlights how cybersecurity incidents can disrupt healthcare operations without confirmed penetration of core systems.
For healthcare IT teams, the priority extends beyond restoring system availability. Effective response requires identifying affected endpoints, containing confirmed threats, preserving evidence, and validating remediation.
Combining endpoint investigation with coordinated clinical continuity planning helps organizations reduce operational disruption and restore services more safely.
Strengthen healthcare endpoint threat response.
Investigate suspicious activity, isolate affected endpoints, and streamline response with Hexnode XDR.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
