“UNM Health patients should not show up to UNM Health facilities on October 26. Emergencies should be handled by 911 and non-emergencies should be delayed until further notice,” UNM Health wrote on October 26, directing patients away from its campuses as the medical system responded to a cyber incident.
UNM Health response and operational timeline
The University of New Mexico Health Sciences Center (UNM HSC) disclosed the incident on Monday, October 26 at 2:30pm MDT and announced that all appointments, including scheduled surgeries, were cancelled for the remainder of the day. Later that evening—at 10:27pm on October 26—UNM posted an update saying all UNM Health hospitals had reopened and that clinics would resume regularly scheduled appointments and procedures beginning Tuesday, October 27.
In its update, UNM said that “At 2:30pm, UNM Health began resuming operations and bringing systems back online in phases, as it was safe to do so.” The health system also stated it would work with patients to reschedule missed appointments and procedures. As part of the response, UNM canceled classes on the Health Sciences campus and sent non-essential employees home.
Clinical services, ambulances and patient volume
The disruption forced active operational changes: ambulances were diverted and surgeries were cancelled. The system told patients not to present at facilities on October 26 and instructed emergencies to be handled through 911 while asking that non-emergencies be delayed. UNM HSC serves a large patient population—more than one million patient visits per year, composed of roughly 900,000 outpatient appointments and about 100,000 emergency room visits— magnifying the operational stakes of a temporary outage.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAcademic disruption at the Health Sciences campus
The incident extended beyond clinical operations to education. All students enrolled at the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health were told to leave campus on Monday. UNM canceled classes on those Health Sciences units for Tuesday, October 27 as well, including online and remote instruction; non-essential employees will remain at home. By contrast, classes at UNM’s central and branch campuses were not affected. The Center had 2,670 students enrolled in its classes in 2025.
BYOD ransomware group's public claim and alleged data exfiltration
UNM provided no public technical details about the nature of the incident or any identified perpetrators in its communications. Separately, cybersecurity intelligence firm VenariX posted on X that an emerging ransomware group known as BYOD listed the University of New Mexico on its data leak site. According to VenariX’s post, BYOD claimed to have compromised 36,000 machines and to have exfiltrated sensitive data including student and employee personally identifiable information (PII), research data, student records and internal emails.
On its data leak site, the group posted: “This is your entire network and infrastructure compromised, the entire university COMPLETELY.” Those statements, as reported by VenariX, are the public attribution and allegation available at the time of UNM’s own service interruptions and subsequent partial recovery notice.
What this means for emergency responders, students, and patients
- Emergency responders: Ambulance diversion and the instruction to use 911 for emergencies indicate first-responder routing and on-scene triage were actively affected during the outage; emergency services remained the recommended channel for acute needs.
- Students and staff on the Health Sciences campus: Students were directed to leave campus and multiple colleges suspended classes through October 27, with non-essential employees sent home, interrupting clinical education and normal campus activity.
- Patients and appointment holders: UNM canceled same-day appointments and surgeries for October 26 and said clinics would resume on October 27; the health system committed to working with patients to reschedule missed care.
The incident stretched across clinical care, medical education and claims of mass data theft. UNM reported phased restoration of systems and a planned return to scheduled services; an outside intelligence firm reported a public claim by BYOD and a listing on a data leak site alleging compromise of 36,000 machines and multiple categories of sensitive data. How those allegations align with UNM’s internal assessment and whether additional patient or student notifications will follow were not detailed in the system’s public messaging.
Original reporting: https://www.infosecurity-magazine.com/news/cyber-unmhealth-surgeries/
