# Ransomware Attack on UNM Health Cancels Surgeries and Diverts Ambulances (BYOD Group Attributed)

> On 2026-10-26 the University of New Mexico Health Sciences Center suffered a cyber incident that cancelled surgeries and clinic appointments, diverted ambulances and cancelled classes. The emerging BYOD extortion group claimed the attack on its leak site, alleging 36,000 compromised machines and theft of PII, research data, student records and internal emails; clinical operations resumed 2026-10-27.

- **Published:** 2026-10-27T17:01:29Z
- **Last reviewed:** 2026-10-27T22:12:42.016Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4553
- **ID:** TL-2026-4553
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** BYOD
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-26 (around midday MDT; sources give 11:30 a.m. to 12:07 p.m.) the University of New Mexico Health Sciences Center (UNM HSC) and UNM Health experienced a cybersecurity event. Administrators messaged staff to disable devices, UNM Hospital diverted all ambulance traffic (including Sandoval Regional Medical Center), new patient acceptance was limited between roughly 12:30 and 2:30 p.m., all clinic appointments and outpatient surgeries were cancelled for the day, non-essential staff and students were sent home, and an Emergency Operations Center was activated. Classes at the Schools/Colleges of Medicine, Nursing, Pharmacy and Population Health were cancelled on 2026-10-26 and 2026-10-27 and academic and research units were closed through Tuesday. UNM said HSC IT security teams moved to contain the event, notified state and federal law enforcement and engaged external partners. UNM stated it is limited in what it can share because of the active law-enforcement investigation and that the incident may have impacted patients, employees and students. Phased restoration began around 2:30 p.m. and, per the 10:27 p.m. update, hospitals remained open with clinics scheduled to resume 2026-10-27.

A ransom message was reportedly broadcast to hospital and desktop computers and mobile-device Wi-Fi users. It demanded that administrators immediately contact the attackers over the Session encrypted messenger, threatened to 'rape your university to the ground to the point of no operation, heavy lawsuits and risk of closure', and claimed access to 'all of your student and employees' data, personal identifiable information and SSNs, private documents, emails and much more'. The BYOD group claimed responsibility on its data leak site, alleging 36,000 machines across the whole network were compromised and that PII, research data, student records and internal emails were exfiltrated; the claim was surfaced by VenariX and relayed by Infosecurity Magazine. These claims are attacker assertions and have not been independently verified. Notably, UNM has not publicly confirmed the root cause, the use of file-encrypting ransomware, or a verified data breach, and no ransom amount has been reported.

BYOD is an emerging extortion operation first tracked in September 2026 (WatchGuard lists five early victims with extortion dates between 2026-09-29 and 2026-10-04). It is classed as a 'data broker' using direct and double extortion, publishes a Tor leak site and contacts victims via email and Session. Its leak site is reported to look identical to that of the UmBra group, which began operating at about the same time, suggesting an association that is unconfirmed. Other claimed BYOD victims include Trump Mobile Wireless (2026-10-05) and T-Mobile Germany (2026-10-07). The initial access vector, malware, tooling and dwell time for the UNM intrusion are not public. No CVE has been tied to the incident, and no C2 matches were found in BeaconBeagle for the BYOD onion address. Note that UNM Health disclosed unrelated earlier privacy incidents (2021, and a 2025 incident affecting 637,252 individuals); they are not part of this campaign.

## MITRE ATT&CK

- T1491.001 Internal Defacement
- T1657 Financial Theft
- T1114 Email Collection

## Sources

- [Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances](https://www.infosecurity-magazine.com/news/cyber-unmhealth-surgeries/)
- [Update on Cybersecurity Event at UNM Health Sciences Center](https://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hsc)
- [Cyberattack forces closure of UNM HSC and suspension of classes, research through Tuesday - The Daily Lobo](https://www.dailylobo.com/article/2026/10/cyberattack-forces-closure-of-unm-hsc-and-suspension-of-classes-research-through-tuesday)
- [University of New Mexico Hospital diverting ambulance traffic due to 'cybersecurity' issue - Source New Mexico](https://sourcenm.com/2026/10/26/university-of-new-mexico-hospital-diverting-ambulance-traffic-due-to-cybersecurity-issue/)
- [Cybersecurity Incident at UNM Health Disrupts Clinical Operations and Forces Ambulance Diversions - Diamatix](https://diamatix.com/unm-health-cyber-incident-healthcare-operational-resilience/)
- [WatchGuard Ransomware Tracker: BYOD](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/byod)
- [Ransomware Group BYOD Targets T-Mobile Germany - dexpose](https://www.dexpose.io/ransomware-group-byod-targets-t-mobile-germany/)
- [Ransomware Group BYOD Claims Trump Mobile Data Breach - SC Media](https://www.scworld.com/brief/ransomware-group-byod-claims-trump-mobile-data-breach)
- [WatchGuard Ransomware Tracker: UmBra](https://www.watchguard.com/fr/wgrd-security-hub/ransomware-tracker/umbra)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4553