Threat reportRansomwareTL-2026-4553
Ransomware Attack on UNM Health Cancels Surgeries and Diverts Ambulances (BYOD Group Attributed)
Ransomware Attack on UNM Health Cancels Surgeries and (TL-2026-4553), also tracked as UNM Health cyberattack, is a high-severity ransomware operation, first published 2026-10-27. It is attributed to BYOD with low confidence, affects University of New Mexico UNM Health hospitals, clinics and Health, maps to 3 MITRE ATT&CK techniques (T1114, T1491.001, T1657), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 3MITRE ATT&CK
- Actors
- 1BYOD
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4553
- Threat ID
- TL-2026-4553
- Also known as
- UNM Health cyberattack, UNM HSC cybersecurity event
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- BYOD
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- health, education, research
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 13
- Updates
- 2026-10-27 · revalidated 1× · latest source
Malware and tooling in Ransomware Attack on UNM Health Cancels Surgeries and
Malware and tooling: BYOD ransomware, Session, Tor - S0183
How Ransomware Attack on UNM Health Cancels Surgeries and works
On 2026-10-26 the University of New Mexico Health Sciences Center suffered a cyber incident that cancelled surgeries and clinic appointments, diverted ambulances and cancelled classes. The emerging BYOD extortion group claimed the attack on its leak site, alleging 36,000 compromised machines and theft of PII, research data, student records and internal emails; clinical operations resumed 2026-10-27.
On 2026-10-26 (around midday MDT; sources give 11:30 a.m. to 12:07 p.m.) the University of New Mexico Health Sciences Center (UNM HSC) and UNM Health experienced a cybersecurity event. Administrators messaged staff to disable devices, UNM Hospital diverted all ambulance traffic (including Sandoval Regional Medical Center), new patient acceptance was limited between roughly 12:30 and 2:30 p.m., all clinic appointments and outpatient surgeries were cancelled for the day, non-essential staff and students were sent home, and an Emergency Operations Center was activated. Classes at the Schools/Colleges of Medicine, Nursing, Pharmacy and Population Health were cancelled on 2026-10-26 and 2026-10-27 and academic and research units were closed through Tuesday. UNM said HSC IT security teams moved to contain the event, notified state and federal law enforcement and engaged external partners. UNM stated it is limited in what it can share because of the active law-enforcement investigation and that the incident may have impacted patients, employees and students. Phased restoration began around 2:30 p.m. and, per the 10:27 p.m. update, hospitals remained open with clinics scheduled to resume 2026-10-27.
A ransom message was reportedly broadcast to hospital and desktop computers and mobile-device Wi-Fi users. It demanded that administrators immediately contact the attackers over the Session encrypted messenger, threatened to 'rape your university to the ground to the point of no operation, heavy lawsuits and risk of closure', and claimed access to 'all of your student and employees' data, personal identifiable information and SSNs, private documents, emails and much more'. The BYOD group claimed responsibility on its data leak site, alleging 36,000 machines across the whole network were compromised and that PII, research data, student records and internal emails were exfiltrated; the claim was surfaced by VenariX and relayed by Infosecurity Magazine. These claims are attacker assertions and have not been independently verified. Notably, UNM has not publicly confirmed the root cause, the use of file-encrypting ransomware, or a verified data breach, and no ransom amount has been reported.
BYOD is an emerging extortion operation first tracked in September 2026 (WatchGuard lists five early victims with extortion dates between 2026-09-29 and 2026-10-04). It is classed as a 'data broker' using direct and double extortion, publishes a Tor leak site and contacts victims via email and Session. Its leak site is reported to look identical to that of the UmBra group, which began operating at about the same time, suggesting an association that is unconfirmed. Other claimed BYOD victims include Trump Mobile Wireless (2026-10-05) and T-Mobile Germany (2026-10-07). The initial access vector, malware, tooling and dwell time for the UNM intrusion are not public. No CVE has been tied to the incident, and no C2 matches were found in BeaconBeagle for the BYOD onion address. Note that UNM Health disclosed unrelated earlier privacy incidents (2021, and a 2025 incident affecting 637,252 individuals); they are not part of this campaign.
MITRE ATT&CK techniques used in TL-2026-4553
Collection
Impact
Affected products and versions in Ransomware Attack on UNM Health Cancels Surgeries and
- University of New Mexico — UNM Health hospitals, clinics and Health Sciences Center IT environment (UNM Hospital, Sandoval Regional Medical Center, outpatient clinics, academic and research units)
Vulnerable versions: Not disclosed
Remediation for Ransomware Attack on UNM Health Cancels Surgeries and
Patches
- No CVE has been associated with this incident; apply current vendor patches to internet-facing and identity systems as general hygiene
Immediate actions
- Isolate affected hospital, clinic and campus network segments and disable affected endpoints as UNM did; preserve volatile and disk evidence before reimaging
- Engage law enforcement (FBI) and an external IR partner; do not contact the attackers over Session without legal and IR guidance
- Hunt for the BYOD Session ID, email contact and ransom-message text across endpoint and email telemetry
- Reset credentials for privileged and service accounts and review remote access, VPN and identity-provider logs
- Activate downtime procedures for clinical systems and ambulance diversion plans
Workarounds
- Block Session messenger and Tor traffic on managed networks where not operationally required
- Restrict mass software or script deployment tooling to dedicated administrative paths with alerting
Longer-term hardening
- Segment clinical, research, student and guest/mobile Wi-Fi networks from administrative and domain infrastructure
- Maintain offline, immutable, tested backups for clinical and research systems
- Deploy EDR with ransomware behavioural detections on all managed endpoints and enforce phishing-resistant MFA
- Monitor for mass endpoint message or wallpaper changes and unusual large outbound transfers
- Prepare breach-notification workflows for HIPAA and FERPA-covered data
Timeline of Ransomware Attack on UNM Health Cancels Surgeries and
- Earliest BYOD extortion dates recorded by WatchGuard (2026-09-29 to 2026-10-04) for five initial victims across IT, telecom, construction and metals sectors; group first tracked in September 2026
- Byod claims Franklin Empire (Canadian electrical distributor), alleging 700GB stolen including AWS keys, API keys and SMTP credentials.
- BYOD claims a cyberattack on Trump Mobile Wireless, posting customer data on its leak site
- Byod claims Gate Crypto Exchange, alleging 12 million user records.
- BYOD claims T-Mobile Germany, threatening publication unless the victim makes contact
- UNM issues updates at 6:08 p.m. and 10:27 p.m.: hospitals remain open, clinics to resume 2026-10-27, classes cancelled 2026-10-27
- BYOD claims responsibility on its leak site, alleging 36,000 compromised machines and theft of PII, research data, student records and internal emails (relayed via VenariX)
- UNM contains the event, activates its Emergency Operations Center, notifies state and federal law enforcement and engages external partners; LoboAlert closure notice sent about 2:29 p.m. and phased system restoration begins about 2:30 p.m.
- Attackers broadcast a message to hospital and desktop computers demanding immediate contact via Session and claiming access to student and employee PII, SSNs, documents and emails
- Around midday MDT UNM HSC administrators tell staff to disable devices as a cyberattack hits UNM Health; ambulance traffic is diverted, new patient intake limited (about 12:30-2:30 p.m.) and all clinic appointments and outpatient surgeries cancelled
- Per BleepingComputer, Byod claims Active Directory forests, Group Policy, a Microsoft Entra tenant and two Oracle databases were compromised and SSNs, HR/payroll, Banner student records, patient data and Cerner EHR rosters stolen; it also claims it will provide free decryption keys to healthcare facilities and offered up to $2,500 per affected patient. All unverified.
- UNM states the event affected some end-user devices but did not penetrate core systems or servers, disputing Byod's claim that the entire network was compromised; patients and staff are warned to watch for phishing.
- UNM reports at 2:02 p.m. that all critical electronic systems are back online, ambulances have returned to normal and hospitals are fully reopened; the incident remains under criminal investigation.
- Regular appointments and procedures resume at UNM Health; classes at the health sciences schools remain cancelled and Infosecurity Magazine reports the incident and BYOD claim
Update history for TL-2026-4553
- 2026-10-27 — Byod Ransomware Attack on UNM Health Disrupts Patient Care and Surgeries: What changed No severity, exploitability or status change. Existing record stays HIGH / ACTIVE. New indicators (1) 1 new victim organization entity (Gate Crypto Exchange). Victim domains (franklinempire.com, gate.com) and claimed victim-env
Sources cited for Ransomware Attack on UNM Health Cancels Surgeries and
- Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances
- Update on Cybersecurity Event at UNM Health Sciences Center
- Cyberattack forces closure of UNM HSC and suspension of classes, research through Tuesday - The Daily Lobo
- University of New Mexico Hospital diverting ambulance traffic due to 'cybersecurity' issue - Source New Mexico
- Cybersecurity Incident at UNM Health Disrupts Clinical Operations and Forces Ambulance Diversions - Diamatix
- WatchGuard Ransomware Tracker: BYOD
- Ransomware Group BYOD Targets T-Mobile Germany - dexpose
- Ransomware Group BYOD Claims Trump Mobile Data Breach - SC Media
- WatchGuard Ransomware Tracker: UmBra
Detection coverage for TL-2026-4553
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4553 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4553
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.