On October 26, the University of New Mexico Health Sciences Center detected a cybersecurity event around 11 a.m. local time and began shutting down systems within the hour. By 2:30 p.m. MDT the health system had announced the incident publicly, diverted ambulances to hospitals in Albuquerque and Santa Fe, and canceled the day's scheduled surgeries and outpatient appointments. UNM Hospital is the state's only Level 1 trauma center, and the Health Sciences Center also runs New Mexico's only children's hospital and burn unit.
A group calling itself BYOD claimed the attack on its dark web leak site that evening, saying it had compromised about 36,000 machines across the university's main campus and hospital networks. The group said it accessed both Active Directory forests and the Microsoft Entra tenant, two Oracle databases, HR and payroll systems, Banner student records, internal email, research data, and patient rosters drawn from the Cerner electronic health record. It threatened to publish stolen Social Security numbers and other personal data unless paid. UNM has not confirmed any of those figures and has not said whether ransomware encrypted its systems.
Ambulance diversions lasted about two hours before UNM Hospital and Sandoval Regional Medical Center reopened the same evening. Clinics resumed their regular schedules the next day, October 27, though classes at the Schools of Medicine, Nursing, Pharmacy and the College of Population Health stayed canceled through that day while the university investigated. By October 28, UNM said critical systems were back online and its own assessment was that the incident reached end user devices rather than core servers, a narrower scope than BYOD's public claims.
UNM notified state and federal law enforcement the day of the attack and brought in outside incident response support, standard steps for an active criminal matter that the university says limit what it can disclose publicly. BYOD itself is a newly surfaced group with no established track record. Researchers tracking its leak site say its infrastructure and prior history remain unverified, typical of an extortion crew in its first weeks of operation.
The attack's publicized details describe a corporate and campus IT compromise rather than a flaw in any specific clinical device, but the response pattern is the one that matters to device manufacturers and hospital biomed teams alike. When an enterprise wide incident forces a health system to unplug desktops and cut Wi-Fi across an entire campus, networked infusion pumps, monitors and imaging systems that share VLANs or authentication infrastructure with compromised corporate systems face the same containment decisions, whether or not they were ever touched. A hospital that cannot show its clinical network segments cleanly from Active Directory and Entra during an incident like this one will take longer to bring devices back online, and manufacturers should expect customers to ask for proof of that separation after an event like UNM's.
UNM has not yet filed a breach notification with HHS for this incident, and the scope BYOD claims, tens of thousands of systems and six figure numbers of patient, student and employee records, remains unverified by any independent party as of October 28. The university's statement that the breach reached end user devices but not core systems or servers is the only scoping claim either side has committed to publicly.