Emerging ThreatsData Breaches

University of New Mexico Grapples with Health Sciences Center Cyberattack

Analyst 207||Source: TheRegister
Hospital corridor with medical staff walking in distance, blurred equipment in foreground, and natural daylight from large…

"The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026," the university said in a statement on Monday evening.

How UNM moved to contain the incident

UNM's statement says HSC information technology security teams "immediately took steps to contain the event and protect the network." The university reported that teams notified state and federal law enforcement and "engaged external partners to assist with the investigation." Leadership activated an Emergency Operations Center to coordinate response and guidance for HSC employees, students, and UNM Health frontline providers.

The university announced the attack at 1430 local time on Monday and, at that moment, cancelled all remaining clinics and classes, dismissed everyone other than critical and clinical staff, and urged patients not to attend HSC facilities.

Service disruptions: clinics, classes, ambulances

On Tuesday the university cancelled classes across the medicine, nursing, and pharmacy faculties for a second day as recovery continued. The attack forced the Health Sciences Center to shut down systems, cancel appointments and clinics at UNM Health hospitals, and divert ambulances to healthcare facilities in nearby Albuquerque and Santa Fe. The source reports that hospital appointments and clinics returned to normal "today," while nonessential UNM Health Sciences Center staff were asked to remain at home.

Public claims of responsibility from a ransomware group

Within hours of the outage, a newly assembled group calling itself BYOD claimed responsibility and posted specific and wide-ranging assertions. The group said it compromised 36,000 machines, "both [Active Directory] forests," two Oracle databases, the personal data belonging to every student and employee, as well as internal emails and data from other systems.

The university has not publicly commented on the nature of the attack, and the register cautioned that "just because a purported ransomware group took credit for the attack, it does not mean they actually were responsible, nor does it mean they deployed a ransomware/locker payload as part of the attack."

BYOD's debut and the question of credibility

The reporting places BYOD's claim in the context of the group's recent activity: its first named victim reportedly was Trump Mobile, with data allegedly leaked for all 3,615 customers. The article notes that BYOD’s claims about breaching Trump Mobile's customer database "appear to have held up." A rival group, EndZone, had claimed a similar breach a week earlier, and some experts suggested the two could be one and the same. The piece also recalls that "In May, the Trump Mobile was found leaking thousands of people's data via a poorly secured website."

The Register stressed that a cybercriminal's public claim is not proof of responsibility; it cited the UNM spokesperson declining additional questions and directing reporters back to the university's public statement.

What this means for students, UNM Health staff, and regional EMS/hospitals

  • Students and faculty in medicine, nursing, and pharmacy: classes were cancelled for a second consecutive day and the university asked nonessential HSC staff to remain home, disrupting instruction and campus routines.
  • UNM Health clinical staff and patients: while hospital appointments and clinics were reported to have returned to normal "today," the initial closure required cancellation of clinics and appointments and dismissal of noncritical personnel, with the emergency response center coordinating guidance.
  • Regional emergency services and neighboring hospitals in Albuquerque and Santa Fe: ambulances were diverted to nearby facilities during the outage, shifting patient loads and routing decisions outside UNM's system until services stabilized.

The record from UNM is firm about what happened and what the institution did in immediate response: containment steps, law enforcement notifications, outside partners engaged, and an activated Emergency Operations Center. Beyond those actions, questions remain about the precise technical nature of the attack and whether the public claims by BYOD reflect what unfolded inside HSC systems.

Original reporting: The Register — Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack

CyberattackEducationEmerging ThreatsHealthcareIncident ResponseNation-StateRansomwareUNMUniversity Of New MexicoHealth Sciences Center
Related Intelligence

Continue Reading

Blurred computer workstation in a dimly lit online retail store's back office with stacks of boxes and shelves in the…

Magento Sites Compromised by Advanced Scanner-Evading Malware

A sneaky malware attack has hit 953 online stores, mostly running on Magento, with a clever JavaScript loader that can tell real customers from automated security scanners - and gives scanners the cold shoulder. This stealthy campaign has been active since July 2025, quietly evading detection and putting unsuspecting shoppers at risk.

Analyst 207
Hospital corridor with medical staff amidst closed department doors, natural daylight casting a calm atmosphere.

Ransomware Targets UNM Health, Disrupts Medical Operations

A ransomware attack forced UNM Health to shut down its facilities on October 26, prompting patients to seek emergency care elsewhere and delay non-emergency visits until further notice. All appointments, including surgeries, were cancelled for the day, but hospitals reopened and regular operations resumed later that evening.

Analyst 207
Laptop on a tidy desk with blurred office supplies and an abstract pattern on the screen.

Warp Breach Exposes AI Agent Logs, User Telemetry Data

A breach at Warp exposed AI agent logs and user telemetry data, impacting around 1% of users, according to CEO Zach Lloyd, who assured that the company acted swiftly to contain the incident within hours. Warp has notified affected users and is working with cybersecurity experts to investigate further.

Analyst 207
Cybersecurity operations room with large screen displaying dashboard.

CISA confirms active PHP2Shell exploits, sets patch deadline

CISA has confirmed that PHP2Shell exploits are being actively used to attack vulnerable systems, and is requiring federal agencies to patch the flaws by October 29. This urgent deadline comes after the agency added the vulnerabilities to its list of known exploits, warning of a clear and present danger to cybersecurity.

Analyst 207