Cyberattack on University of New Mexico Health Sciences Center disrupts hospitals and cancels classes

On 26 October 2026, the University of New Mexico Health Sciences Center — the state's academic medical complex, which runs UNM Hospital in Albuquerque alongside its medical, nursing, pharmacy and population-health schools — was hit by a cyberattack that disrupted patient care and academic operations. The university announced the incident at around 2:30 p.m. local time, cancelled remaining clinics and classes, sent home all but critical and clinical staff, and urged patients to stay away from Health Sciences Center facilities.

The disruption forced UNM Health to temporarily limit new patient admissions and divert ambulances to other healthcare facilities in Albuquerque and Santa Fe, while outpatient surgeries and appointments were suspended. UNM Hospital — home to the region's Level I trauma center — and Sandoval Regional Medical Center remained open, and the public was advised to call 911 in an emergency. Classes at the four health sciences schools were cancelled on 26 and 27 October, and non-essential staff were told to stay home.

Who claimed it

UNM did not disclose the type of attack, but an extortion group calling itself Byod claimed responsibility on the afternoon of the attack. The group asserted it had compromised roughly 36,000 systems across the campus and hospital environments — including Active Directory forests, the Microsoft Entra tenant and two Oracle databases — and claimed access to Social Security numbers, payroll and HR data, student records, internal emails and patient and electronic health record information. Those claims were not independently verified, and UNM's own assessment said the event "affected some end-user devices but did not penetrate core systems or servers." Byod, which describes its activity as "pentesting," has been linked by researchers to earlier breach claims, and some suspect it overlaps with another group.

Recovery

In a statement, the university said its IT security teams moved to contain the event and protect the network, notified state and federal law enforcement, and brought in external partners. By the following day UNM Health Sciences reported that all critical electronic systems were back online, all UNM Health hospitals were fully open, ambulance traffic had returned to normal, and clinics had resumed scheduled appointments and procedures. The university warned patients, staff and students to stay alert for unsolicited communications and phishing, and said recovery was continuing in phases, leaving the incident contained but with the full scope of any data theft still unconfirmed.