UNM Health cyberattack: ambulances diverted, clinics closed

On Monday 26 October 2026 the University of New Mexico Health Sciences Center (HSC), which includes the UNM Health hospital system in Albuquerque, suffered a cyberattack that forced it to divert ambulances to other hospitals and suspend outpatient appointments and surgeries at more than 30 clinics. UNM Hospital houses New Mexico’s only Level 1 trauma center and, according to The Record, also the state’s only burn unit and children’s hospital. The facts are reported by SecurityWeek (Associated Press), Help Net Security, Infosecurity Magazine, The Record, The Register, BleepingComputer and DataBreaches.net.

Timeline

• Around 11:30 a.m. (local time): according to an internal message quoted by Help Net Security, the network intrusion is detected. About 40 minutes later staff are told to shut down and unplug their computers and turn off Wi-Fi on mobile devices; according to local outlets cited by The Record, the alert reaches employees’ phones.
• Late morning: several employees say they heard a voice message on their computers (synthetic, according to the student newspaper Daily Lobo) claiming the theft of student, employee and patient data and asking to be contacted through an encrypted messaging service.
• 2:30 p.m.: the HSC announces the incident. Ambulances are diverted for about two hours to facilities in Albuquerque and Santa Fe; Presbyterian Healthcare Services and Lovelace Health System take additional patients.
• Evening: an Emergency Operations Center is activated, external partners and state and federal law enforcement are involved (the FBI confirms it is “assisting”). Hospitals reopen and systems come back online in phases.
• 27 October: clinics resume, but classes in medicine, nursing, pharmacy and population health stay cancelled (online ones included) and nonessential staff stay home. Later that day, according to BleepingComputer, the HSC says all critical electronic systems are back online and ambulance traffic is normal again.

BYOD’s claim and what does not add up

The same Monday the extortion group BYOD, which appeared last month and lists six victims on its leak site (for three it has already published data, according to BleepingComputer), claimed the attack. The group says it compromised 36,000 machines across campus and hospitals, both Active Directory forests, the Group Policy infrastructure, the entire Microsoft Entra tenant, two Oracle databases with HR, payroll and student records (Banner), internal emails, research data, patient information and rosters from the Cerner clinical system.

These claims are unconfirmed. The HSC, quoted by BleepingComputer, says instead that the event affected “some end-user devices” without penetrating core systems or servers. It is also unclear whether ransomware encrypted any data: Help Net Security and The Register consider this still open, while BYOD announced free decryption keys for healthcare facilities and a payment of up to $2,500 per affected patient, while stating it would keep all the data. The university has not commented on the nature of the attack, citing the ongoing investigation.

Technical details

The sources do not give the initial access vector, exploited CVEs or public indicators of compromise. If the claim were true, the picture would be the typical one of intrusions that reach domain control:

• control of identity on premises and in the cloud (Active Directory and Entra ID), which allows creating accounts, changing roles and moving between the two environments;
• abuse of Group Policy (MITRE ATT&CK T1484.001), often used to push scripts or executables at scale;
• exfiltration from databases and mail (T1041, T1114) for extortion;
• possible data encryption for impact (T1486), not confirmed.

The voice message played on workstations stands out: Professor Josephine Wolff (Tufts University), quoted by the AP, calls it “pretty unusual”. The fact that several employees heard it on their own machines suggests execution on many endpoints, but the sources do not explain how it was done.

The response is also worth noting: workstations shut down and unplugged within about 40 minutes of detection, and critical systems restored in about a day. In March, The Record recalls, ransomware at the University of Mississippi Medical Center limited operations for weeks.

Impact for European and Italian organisations

Healthcare is a sector of high criticality under NIS2 (in Italy, Legislative Decree 138/2024): an incident like this requires an early warning to CSIRT Italia within 24 hours and a notification within 72. With health data involved, GDPR obligations also apply (Articles 33 and 34). The UNM case also shows a less visible risk: when a hospital and a university share identity and network, an intrusion on the academic side can stop the clinical side.

What to do now

• Protect the top tiers of identity: separate domain admin accounts (tiering), phishing-resistant MFA, just-in-time privileged access in Entra ID and monitored break-glass accounts.
• Watch Group Policy: alerts on changes to GPO objects (event 5136 with directory service auditing enabled) and on new startup scripts or scheduled tasks pushed from the domain.
• Separate the clinical network from administrative and academic ones, with distinct identities and domains where possible.
• Prepare the emergency shutdown: who orders it, how staff are alerted without the corporate network (SMS, phones) and paper procedures for the emergency department, pharmacy and admissions.
• Offline, immutable backups of Active Directory, Entra configuration and HR and clinical databases, with restore tests.
• Warn the people involved about the targeted phishing that usually follows a data theft claim.

How ARXDOME helps

ARX Sentry collects logs and security events from computers, servers and firewalls and shows them in SOC pages dedicated to identity: bursts of attempts, privileged access, account changes and night-time logons. ARX Shield lets you isolate a suspicious machine from the network with one click and highlights vulnerabilities already exploited by attackers, while ARX Retain keeps logs in Europe for investigations and notifications to the authorities.

Last updated: 27 October 2026