36,000 systems: that is the number the Byod ransomware group said it compromised across the University of New Mexico’s main campus and hospital environments, according to the group’s post on its data leak site reported by BleepingComputer.
Immediate operational impact at UNM Health
UNM Health disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. On Monday the provider began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments. The organization advised the public to call 911 for medical emergencies.
In an update, UNM said UNM Hospital and Sandoval Regional Medical Center remained open. By Tuesday, October 27, the university reported that all clinics would resume scheduled appointments and procedures, ambulance traffic was operating normally, and all UNM Health hospitals were fully open.
Claims from the Byod ransomware group
UNM did not disclose the technical type of the attack, but BleepingComputer reported that a new ransomware group calling itself Byod claimed responsibility. On its data leak site the group said it had compromised "36,000 systems" including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases. The group posted: "This is your entire network and infrastructure compromised, the entire university COMPLETELY."
Byod also said it had access to a broad range of student, employee and hospital data, listing social security numbers, HR and payroll records, Banner student records, internal emails, research data, hospital appointment data, patient information and Cerner EHR rosters. BleepingComputer reached out to UNM Health Sciences for comment on those data-theft allegations but said it had not received a response.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageAlleged bargaining, paradoxical promises, and data retention
The threat actor said it would remove its breach post after the university initiated communication, language commonly associated with ransom negotiations. In a new post the group said it would provide free decryption keys to healthcare facilities and even promised to pay up to $2,500 for every patient affected by the cyberattack. The group wrote: "We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data."
At the same time Byod said it would keep all the stolen data. The group is newly listed as having six victims on its data leak site and, according to the reporting, has already leaked the allegedly stolen data for three of them. On its FAQ page the group described its actions as "pentesting" to expose vulnerabilities and said it selects victims after an initial assessment, focusing on "those at the top who look at consumers and/or customers as a number or another dollar in their pockets."
UNM Health’s recovery and technical assessment
UNM Health Sciences said all critical electronic systems are back online and credited "IT security teams working with external partners to secure the network" for a quick recovery. The university added: "Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers."
UNM also advised patients, staff and students to remain vigilant for unsolicited communications and phishing attacks as the organization and community recover normal operations.
How IT security teams, patients and students are affected
- IT security teams: The incident underscores the importance of rapid containment and external partnerships in restoring services. The university’s statement that core systems and servers were not penetrated will be scrutinized by technical teams as they validate forensic findings and restore confidence in accounts, directories and enterprise tenants the attacker claimed to have accessed.
- Patients and the public: UNM Health is a major statewide specialist provider with more than 1 million patient visits annually and operates New Mexico’s only Level I trauma center housed at UNM Hospital. Temporary admission limits and diverted ambulances show direct, immediate effects on patient routing and elective care when systems are disrupted.
- Students and staff at the Health Sciences Center: Classes at the four health sciences schools were canceled for the day and nonessential HSC employees were told to stay home, reflecting academic disruption beyond clinical operations.
One broader note included in the reporting: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 is cited as measuring defenses technique by technique across 338 million simulations run in customer production environments, a reminder of how security assessments may shift focus from perimeter prevention to post‑access controls.
The attack and the conflicting claims around data extortion, partial restoration, and the scope of systems affected leave concrete technical and operational questions for UNM Health and its partners as they validate forensic findings, notify any affected individuals, and restore confidence in critical systems that support both routine and trauma care.
