UNM Health Faces Disruption Amid Cyberattack; Reported Data Theft by Hackers
On October 27, 2026, the University of New Mexico (UNM) Health Sciences Center found itself embroiled in a significant cyber incident that has severely impacted operations across its health facilities. As New Mexico’s only Level-1 trauma center, the university plays a pivotal role in the region’s healthcare system. However, the cyberattack necessitated immediate responses that included the suspension of patient appointments, the cancellation of classes, and the diversion of ambulances to other hospitals.
The health system first detected the cyber incident on Monday morning. Initial reports suggest that hackers may have stolen sensitive data, prompting the health system’s 618-bed institution in Albuquerque to redirect ambulance traffic to alternative facilities. As a direct consequence, new patient admissions were significantly curtailed and numerous outpatient surgeries across various clinics were postponed for several hours. This disruption came at a time when the flagship UNM Hospital handles over 1 million patient visits annually, including about 80,000 emergency room cases and approximately 20,000 urgent care visits.
The implications of this incident extended beyond the primary hospital, affecting the UNM Sandoval Regional Medical Center in Rio Rancho, which has a 65-bed capacity. Following the cyberattack, UNM Health Sciences Center issued directives for non-essential, non-clinical personnel to vacate the premises for the rest of the day, along with students from the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health. This precautionary measure highlighted the seriousness of the cyber event, signaling to staff and students the need for immediate evacuation to ensure safety.
By Tuesday, operations at UNM Hospital and associated clinics resumed, with regular patient appointments and procedures gradually coming back online. However, the health sciences schools remained closed for an additional day, and non-essential employees were instructed to stay home. Meanwhile, essential and clinical staff, along with students carrying clinical responsibilities, were expected to report for their duties.
In an official statement, the University confirmed the cancellation of all Health Sciences Center (HSC) classes, both online and remote, as a result of this cybersecurity event. Students and staff were informed through updates on the university’s website that services offered by or through the HSC would likely experience temporary disruptions. The continuity of classes at UNM’s Central and branch campuses, however, remained unaffected.
As part of the protocol following such an incident, UNM Health promptly notified local and federal law enforcement agencies and enlisted external partners to aid in the investigation of the cyberattack. Reports from local media outlet KOB4 indicated that the perpetrators behind the attack had employed an unconventional tactic; they sent an audio message to hospital staff’s computers, where a voice, likely generated by a text-to-speech engine, instructed administrators to immediately reach out to the attackers via an encrypted messaging platform known as Session. This message went further, threatening the university with severe consequences if their demands were not met.
Alarming claims from this message included assertions that the hackers possessed a wealth of sensitive data, including personal identifiable information (PII), social security numbers, and other confidential documents. By later that afternoon, a ransomware group known as Byod emerged on the dark web, taking credit for the cyberattack. They alleged that they had exfiltrated a broad range of sensitive data, including employee records, patient information, research documents, student records, payroll data, and internal communications. Additionally, the group claimed to have compromised approximately 36,000 machines within the health system.
Despite these alarming developments, UNM Health has not yet commented specifically on the nature of the cyber incident, including whether the electronic health records (EHR) systems have been impacted or if ransom demands have been made.
This latest incident represents a troubling pattern for UNM Health, as it marks one of several significant cyber threats faced by the institution in recent years. Notably, in August 2021, UNM Health reported a hacking event that affected around 637,300 individuals and was linked to theft from network servers. Although that incident did not compromise the integrity of electronic health record systems, it nonetheless raised concerning questions about the security of patient information.
As cybersecurity measures and protocols continue to evolve, the University of New Mexico’s ongoing commitment to safeguarding sensitive data remains paramount. With tensions high and trust at stake, the university and its health systems face the challenge of not only rectifying the immediate impacts of the cyberattack but also ensuring that robust measures are in place to prevent such incidents in the future.