UNM Health ransomware attack disrupts patient care, surgeries

A cyberattack caused outages across the University of New Mexico Health Sciences Center. The disruption mattered because UNM Health provides specialist care statewide and handles more than 1 million patient visits each year. Its flagship hospital also houses New Mexico’s only Level I trauma center.

At first, UNM Health limited new admissions, diverted ambulances, and suspended outpatient surgeries and appointments. Classes at four health sciences schools were canceled, while nonessential HSC employees were told to stay home. UNM Hospital and Sandoval Regional Medical Center remained open, and people facing emergencies were told to call 911.

By Tuesday, October 27, clinics had resumed scheduled appointments and procedures. UNM later said all critical electronic systems were online, hospitals were fully open, ambulance traffic was normal, and clinics had resumed care. The university said the event affected some end-user devices but did not penetrate core systems or servers.

Ransomware is malicious software that blocks access to computer systems or data, usually while attackers demand payment. Hospitals are especially vulnerable to disruption because clinicians depend on digital records, scheduling, communications, laboratory information, and other connected services. If those tools become unavailable, staff may need slower backup processes.

In this incident, Byod claimed it had compromised systems across UNM’s main campus and hospital environments. UNM Health temporarily limited admissions, diverted ambulances, and suspended outpatient surgeries and appointments. Those changes show how a technology outage can quickly affect real-world medical operations, even when hospital buildings remain open.

The article does not confirm that ransomware caused the outage; it reports Byod’s claim. UNM later said the event affected some end-user devices, not core systems or servers. Its teams and external partners restored critical electronic systems, allowing hospitals, ambulances, clinics, appointments, and procedures to operate normally again.

UNM Health is a major statewide specialist-care provider. It handles more than 1 million patient visits each year. UNM Hospital in Albuquerque is particularly important because it contains New Mexico’s only Level I trauma center, serving the most seriously injured patients.

Byod claimed the attack reached 36,000 systems across the university’s main campus and hospital environments. The group named Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases. It also claimed access to Social Security numbers, payroll and student records, internal emails, research data, appointment data, patient information, and Cerner EHR rosters.

These figures describe the attackers’ allegations, not confirmed findings. UNM said its assessment found that some end-user devices were affected, but core systems and servers were not penetrated. The article does not provide a confirmed number of stolen records or affected patients.

The outage immediately changed how UNM Health handled patients. The organization temporarily limited new admissions and diverted ambulances to nearby hospitals. This reduced pressure on systems and services while the incident was being assessed, but it also disrupted normal access to UNM’s specialist and emergency-care network.

Outpatient surgeries and appointments were suspended, and people with emergencies were told to call 911. UNM Hospital and Sandoval Regional Medical Center remained open. The temporary restrictions were significant because UNM Health sees more than 1 million patients annually, and UNM Hospital houses the state’s only Level I trauma center.

The disruption was short-lived according to UNM’s updates. Starting Tuesday, October 27, clinics resumed scheduled appointments and procedures. UNM later said all critical electronic systems were back online, hospitals were fully open, ambulance traffic was operating normally, and clinics had resumed care.

Byod is described as a new ransomware gang with six victims listed on its data leak site. It had allegedly leaked data from three of them. On its FAQ page, the group called its activity “pentesting” intended to expose vulnerabilities and hold data controllers accountable, while saying no target was off-limits.

Byod claimed it compromised 36,000 UNM systems, including identity and policy infrastructure, the Microsoft Entra tenant, and two Oracle databases. It alleged access to Social Security numbers, HR and payroll records, Banner student records, internal emails, research data, hospital appointments, patient information, and Cerner EHR rosters.

The article does not verify those allegations. UNM did not disclose the attack type, and BleepingComputer said it had not received a response about the data-theft claims. Byod said it would keep stolen data, even while offering decryption keys for healthcare facilities and promising payments for affected patients.

Hospitals need continuity plans because care cannot stop when digital systems fail. In general, those plans can include paper documentation, manual scheduling, backup phone communication, emergency access procedures, and transfers to other hospitals. The goal is to protect urgent care while reducing dependence on unavailable computers.

UNM’s response shows this principle in action, although the article does not list every workaround used. UNM temporarily limited new admissions, diverted ambulances, and suspended outpatient surgeries and appointments. Hospitals remained open, and emergency callers were directed to 911. These measures helped manage care while systems were assessed and secured.

UNM said IT security teams worked with external partners to secure the network. The assessment found effects on some end-user devices, not core systems or servers. Critical electronic systems then came back online, restoring normal ambulance traffic, hospital operations, appointments, and procedures. Future resilience depends on tested downtime plans and rapid restoration support.

Active Directory and Microsoft Entra are identity and access systems. In general, they help organizations manage user accounts, permissions, devices, and access to digital resources. Electronic health records, or EHRs, store and organize patient information for authorized healthcare work. Together, these systems help determine who can reach sensitive data and services.

Byod claimed it had reached UNM’s Active Directory forests, Group Policy infrastructure, entire Microsoft Entra tenant, and Cerner EHR rosters. It also named two Oracle databases. These claims matter because identity systems can influence access across many connected environments, while EHR systems contain clinical and appointment information.

The article does not confirm that Byod controlled these systems. UNM said its assessment found that some end-user devices were affected, but core systems and servers were not penetrated. Still, the claims show why hospitals protect identity infrastructure, permissions, databases, and EHR access as part of patient-care security.