A Cyber Incident Becomes a Healthcare Operations Problem 

On Monday, October 26, 2026, at approximately 11:30 a.m. Mountain Time, computers across the University of New Mexico Health Sciences Center began displaying a blunt message: "You have been compromised." A synthetic voice broadcast over the machines claimed that attackers held students' and employees' personal information, Social Security numbers, private documents, and emails - and demanded contact over the encrypted Session messenger. Within the hour, UNM Health had done something no hospital does lightly: it told every ambulance in the region to go somewhere else. 

For roughly two hours, New Mexico - a state of more than two million people - had no Level I trauma center accepting patients. Every appointment at more than 30 clinics was canceled. Outpatient surgeries were suspended. The health system that handles about 900,000 outpatient visits and 100,000 emergency visits a year went into degraded operations while its staff worked from paper forms.  

By 2:30 p.m., UNM Health began bringing systems back in phases "as it was safe to do so." By Tuesday morning, hospitals were open, clinics were running, and the trauma center was back online. But the extortion group that claims responsibility - a little-known outfit called BYOD - says it compromised 36,000 machines and holds everything from Oracle payroll databases to Cerner EHR rosters. UNM has confirmed none of it. 

For hospital CISOs, OT security leaders, and biomedical engineering teams, the UNM Health incident is a compact case study in why availability - not confidentiality - is the safety-critical cybersecurity property in healthcare, and why identity, network segmentation, and clinical downtime readiness deserve the same rigor as any industrial control environment. 

What Happened at UNM Health? A Verified Incident Summary 

According to the official incident updates from UNM Health Sciences Center, the cybersecurity event affected the entire Health Sciences Center - which includes the UNM Health clinical delivery system - but not UNM's Central and branch campuses.  

The operational consequences on October 26 were severe and immediate: 

• All ambulance traffic diverted to other Albuquerque-area hospitals. 

• All appointments at all clinics canceled; patients told not to present at UNM facilities. 

• Outpatient surgeries and procedures suspended for the remainder of the day. 

• New-patient acceptance limited from 12:30 to 2:30 p.m. 

• Health Sciences classes (School of Medicine, College of Pharmacy, College of Nursing, College of Population Health) canceled; students and nonessential employees sent home. 

• Staff directed at approximately 12:07 p.m. to shut off and unplug computers, disable Wi-Fi on mobile devices, and move to paper workflows.  

The response was coordinated through an activated Emergency Operations Center. UNM notified state and federal law enforcement and engaged external incident-response partners; the FBI's Albuquerque office confirmed it is "assisting our partner" in what remains an active investigation. UNM publicly thanked health systems in Albuquerque and Santa Fe - including Presbyterian Healthcare Services and Lovelace Health System, which absorbed additional patients - for helping ensure continuity of care.  

As of the latest verified update (5:52 a.m. MDT, October 27), UNM Hospital and Sandoval Regional Medical Center are open, clinics resumed normal schedules, the trauma center is "back online to take all levels of trauma," and HSC academic and research units remain closed with nonessential staff working remotely. Some services delivered through HSC may still be disrupted. 

UNM Health Cyberattack Timeline: From Initial Disruption to Recovery 

All times MDT, October 26, 2026, unless noted. 

One detail deserves emphasis: the window from confirmed detection to resumed clinical intake was roughly three hours. That is a far faster operational recovery than the healthcare-sector norm - for comparison, the University of Mississippi Medical Center, also a state's only Level I trauma center, needed nine days to resume normal operations after its February 2026 ransomware attack, and industry analyses put average healthcare downtime at 17 days.  

Who Is Behind the UNM Health Cyberattack? 

An extortion group calling itself BYOD has claimed the attack. On its Tor-based leak site, the group claims to have compromised 36,000 machines across the UNM main campus and hospital environments, including "two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters."  

Every element of that sentence requires a caveat: 

• Attribution is a claim, not a finding. BYOD's listing is indexed by ransomware.live and reported by security trade press, but UNM has not confirmed the group's involvement, and no independent forensic corroboration is public.  

• The claim contains internal tensions. BYOD asserts compromise of the "UNM main campus," yet the university's verified statements say Central and branch campuses were unaffected - either the claim is inflated, or the group's definition of "compromise" is loose. 

• The 36,000-machine figure is unverified, as is every listed data category. Notably, the on-machine audio message broadcast during the attack claimed theft of student and employee data but, in the portion recorded by KRQE, did not claim patient data. 

• The group is better described as an extortion outfit than a proven ransomware operator. Reporting indicates it is unclear whether BYOD encrypts victim systems at all; its model appears to be advertise-the-breach, threaten-disclosure, negotiate.  

No ransom amount, deadline, or payment demand has been documented in any credible reporting. No sample data, screenshots, or file listings from the alleged leak have been publicly authenticated as of this writing. If BYOD publishes purported proof, independent verification against known UNM data structures will be the test - not the claim itself. 

Was This Ransomware? What the Public Evidence Actually Shows 

Honest answer: we don't know yet - and the distinction matters operationally and legally. 

Four different events are frequently conflated in early incident coverage: 

1. System disruption - confirmed at UNM HSC. Computers were taken over, services were interrupted, operations were suspended. 

2. Extortion - a message demanding contact and threatening destruction is consistent with an extortion attempt; whether a monetary demand exists is unverified. 

3. Data theft - claimed by the attackers; unconfirmed by UNM or investigators. 

4. Ransomware encryption - no public evidence of mass encryption exists. The rapid (hours-scale) restoration of clinical intake is consistent with - but does not prove - a scenario where core clinical systems were not encrypted, or where restoration was fast because affected endpoints were rebuilt rather than decrypted. 

The broadcast-audio tactic is genuinely unusual. Tufts cybersecurity policy professor Josephine Wolff, quoted by the Associated Press, noted that "breaching a system to play a message on computers is pretty unusual" - a sign, she said, of "how much work we still have to do to get better at defending ourselves." Behaviorally, the incident most resembles an extortion-and-intimidation intrusion with disruptive effect - possibly involving wiper-like or mass-messaging tooling - rather than a classic double-extortion ransomware deployment. Investigators will be working to determine whether any encryption occurred, how the actor achieved initial access (phishing, exploited remote access, stolen credentials, or a third-party pathway are the usual candidates), and how long they were inside before October 26. 

Until UNM, the FBI, or forensic firms publish findings, "cyberattack with extortion claims" is the most defensible description of this incident. 

What Systems Were Affected - and What Remains Unknown 

Verified as disrupted: UNM HSC computing broadly (staff were told to unplug machines), clinical scheduling and registration workflows (all appointments canceled), emergency and ambulance intake, outpatient surgery operations, academic and research IT, and portions of campus-wide services reachable through HSC. 

Reported but not confirmed: enterprise databases (Oracle HR/payroll, Banner student records), the Entra ID tenant, email stores, and Cerner EHR rosters - all from the unverified BYOD claim. 

Unknown: the initial access vector; whether any endpoint encryption occurred; whether protected health information was accessed; whether biomedical devices, medical imaging, laboratory systems, or building/facility systems were touched; patient harm; and financial impact. 

One verified detail carries analytical weight: the directive to unplug computers is a containment decision, not a finding. It indicates that UNM's response team could not immediately distinguish compromised from clean machines - a rational abundance-of-caution posture when identity and network trust are in question. It is not evidence that medical devices or OT systems were compromised, and it is not evidence they were spared. 

How a Cybersecurity Incident Can Disrupt Hospital Operations 

UNM Hospital is New Mexico's only Level I trauma center - the designated facility for the most severe injuries, including gunshot wounds, stabbings, and complex neurosurgical cases.  

When it diverted ambulances for even a few hours, the burden shifted to Presbyterian, Lovelace, and Santa Fe systems - and one witness at another local emergency room described "widespread chaos and significantly increased wait times."  

This is the core lesson of the incident: a hospital's digital dependency converts IT failures into physical service failures. Consider what the verified disruptions imply: 

• Ambulance diversion and trauma response depend on reliable ED intake, bed management, and communications. When those can't be trusted, the clinically correct decision is diversion - even for a trauma center. 

• Scheduling and registration are the nervous system of outpatient care. Losing them cancels a full day of appointments across 30+ clinics instantly. 

• Paper-based downtime workflows kept care moving - the transition happened within roughly 40 minutes of detection. That speed is not accidental; it reflects drilled procedures. 

• Regional coordination worked: competing health systems absorbed diverted patients, and UNM publicly acknowledged them. Crisis plans that assume neighbors will absorb load only work if relationships and mutual-aid protocols exist before the incident. 

Crucially, none of this required a medical device to be hacked. The disruption flowed from enterprise IT and shared services - which, in a modern hospital, are the clinical delivery infrastructure. 

The Healthcare OT Security Connection 

Hospitals are industrial facilities that happen to deliver care. Beyond the EHR, they run a hidden operational technology layer: networked infusion pumps, patient monitors, laboratory analyzers, imaging modalities and PACS, pharmacy automation, environmental controls, nurse-call systems, pneumatic tube networks, and building management systems governing HVAC, medical gases, and power. These systems increasingly share the same identity stores, network infrastructure, and management planes as enterprise IT. 

That convergence is where the UNM incident - even with zero confirmed OT compromise - becomes an OT security case study: 

Identity is the shared dependency. The claimed compromise of an "entire Entra tenant," if substantiated, would represent the single most consequential failure mode in a converged hospital. Identity and access management underlies EHR logins, clinical application access, VPN and remote vendor access, email, and the management interfaces of networked biomedical devices. A compromised directory means you can no longer trust any authentication decision - which is precisely the condition under which an incident commander orders staff to unplug machines. NIST SP 800-82 and the IEC 62443 zone-and-conduit model both assume that control zones are only as strong as the identity and remote-access pathways leading into them. 

Network segmentation determines blast radius. An architecture that isolates biomedical device networks and building OT behind conduits - with no direct path from user workstations or the internet - limits what a compromised enterprise account can reach. The speed of UNM's phased restoration suggests segmentation existed between enterprise systems and core clinical platforms; the breadth of the shutdown suggests segmentation between user machines and enterprise services was either absent or untrusted. 

Passive visibility is a safety requirement. Active scanning can destabilize legacy medical devices; passive network detection is the only safe way to establish asset inventory and spot anomalous communications in clinical environments. Organizations that cannot see what their infusion pumps and imaging systems talk to cannot validate that those pathways stayed clean during an incident. 

Detection must span IT and OT telemetry. Unusual authentication, impossible travel on administrative accounts, new remote-access sessions, unexpected east-west traffic toward clinical VLANs, and mass file-access patterns are the early indicators of exactly this class of incident. Correlating identity logs, EDR alerts, and passive OT network monitoring in one detection plane is what shortens the 40 minutes between detection and unplugging - or eliminates the need for it. 

None of this asserts that UNM's OT or medical devices were breached. It asserts something more useful: the operational consequences were identical either way. When digital infrastructure fails, clinical continuity degrades - which is why hospital resilience planning must treat biomedical and facility OT as in-scope for cyber risk assessment, even when the incident lives entirely in IT. 

Assessing the Cyberattack's Operational, Data, Financial, and Safety Implications  

Context worth remembering: this is not UNM's first rodeo. In 2021, the Hive ransomware group breached UNM Health's network (access from early May; discovered June 4), exposing data of 637,252 patients - though the EHR itself was not accessed in that incident.  

A second major incident five years later will sharpen regulatory, legal, and public scrutiny. 

What Hospital CISOs and OT Security Leaders Should Learn 

1. Availability is the safety-critical property. Ransomware dominates headlines because of data theft, but the UNM incident's most consequential moment was an ambulance diversion, not a leak. In healthcare, integrity and availability failures become patient-safety events within minutes. Risk registers and board metrics should treat clinical availability as a first-class outcome. 

2. Recovery speed is a segmentation dividend. Three hours from detection to resumed intake is exceptional for this sector. The most plausible technical explanation is that core clinical platforms were separable from whatever was compromised - deliberate or fortunate. Build segmentation so the explanation is always deliberate. 

3. Containment decisions are clinical decisions. Ordering staff to unplug computers interrupts nursing workflows, medication scanning, and documentation. UNM's rapid switch to paper - within roughly 40 minutes - shows downtime procedures were drilled, not documented-and-forgotten. The exercise metric that matters: how long can each critical unit run degraded, and does staff actually know how? 

4. Identity compromise is the scenario that breaks containment logic. When you can't trust authentication, every machine is suspect. Phishing-resistant MFA, privileged access management, tiered administration, and rapid credential-reset playbooks are the difference between a contained incident and a hospital-wide unplug order. If the BYOD claim about the Entra tenant is even partially true, identity hardening is the remediation UNM will emphasize. 

5. Uncertainty must be an explicit input to executive decisions. For the first 24 hours, UNM's leadership operated with unknown scope, unknown actor, unknown data impact - yet still made defensible operational calls (divert, cancel, unplug, restore in phases). Pre-authorized playbooks for diversion, cancellation, and degraded-mode operation are what make decisions fast and safe under uncertainty. 

6. Regional interdependence is a security dependency. Your hospital's cyber resilience plan includes your competitors. Mutual-aid agreements, shared EMS coordination protocols, and pre-planned diversion capacity are cyber resilience controls, not just emergency-management paperwork. 

A Practical Hospital Cyber Resilience and Remediation Plan 

Phase 1 - Immediate response (0–24 hours) 

• Activate incident command with clinical leadership at the table, not on a bridge afterward. 

• Establish an out-of-band, verified communication channel (the Session-messenger contact demand shows attackers exploit normal channels). 

• Decide diversion/cancellation thresholds before scope is confirmed; document who can declare them. 

• Preserve volatile evidence before mass shutdowns where possible - then accept that patient safety outranks forensics. 

• Isolate by network zone, not by indiscriminate power-down, wherever switching/radar telemetry confirms scope. 

• Invoke tested downtime procedures per unit; assign downtime documentation leads. 

Phase 2 - Stabilization and recovery (24–72 hours) 

• Restore in clinical-priority order: life-safety and clinical-dependency systems first, administrative last. 

• Validate identity infrastructure integrity before re-admitting users - reset privileged credentials, review conditional access policies, hunt for persistence. 

• Verify medical device and facility-system functionality deliberately: infusion pump drug libraries, imaging modality connectivity, lab middleware interfaces, HVAC/BMS alarming. 

• Reconcile paper records into systems of record with dual verification. 

• Heighten monitoring for reinfection - restoration is when actors who maintained persistence re-assert themselves. 

• Assess data exposure with forensic rigor before any public statement on theft. 

Restoring connectivity is not recovery. Recovery is complete when clinical leadership signs off that care processes are safe at full load - a higher bar than "systems ping." 

Phase 3 - Strengthening resilience (7–30 days) 

• Commission root-cause analysis; map the full intrusion path. 

• Remediate confirmed vectors; hunt for the same weaknesses in peer systems. 

• Re-segment where the incident showed unnecessary trust; lock down vendor remote access with time-bound, recorded sessions via jump hosts. 

• Review backups for integrity, immutability, and isolation from the compromised identity plane. 

• Rehearse the updated response plan with a tabletop that includes EMS and neighboring systems. 

Phase 4 - Long-term program maturity (30–90 days and beyond) 

• Achieve continuous asset visibility across IT, biomedical, and facility OT - passive discovery for anything that can't tolerate scanning. 

• Align segmentation architecture to IEC 62443 zones/conduits and NIST SP 800-82 guidance; benchmark with NIST CSF 2.0. 

• Tie security metrics to operational risk: time-to-safe-degraded-mode, time-to-restore-clinical-service, percentage of clinical VLANs with passive monitoring coverage. 

• Put OT/medical-device cyber risk on the board agenda with the same weight as enterprise IT risk. 

CISO Checklist: Is Your Hospital Prepared for a Similar Incident? 

1. Can our emergency and critical-care operations continue - verifiably - during a total IT outage? (Ask for the drill evidence, not the policy.) 

2. How long from detection to paper-based degraded mode in each critical unit? 

3. Do we have a current, validated inventory of connected medical devices and facility OT - including what they communicate with? 

4. If our identity tenant were untrusted tomorrow, could we isolate clinical systems by network controls rather than unplugging everything? 

5. Are enterprise, clinical, biomedical, and building networks segmented with monitored conduits - and when did we last validate that in practice? 

6. Can we detect unauthorized remote access and anomalous east-west movement toward clinical VLANs today? 

7. Are privileged accounts and vendor remote connections under MFA, time-bound, and session-recorded control? 

8. Do our recovery time objectives reflect clinical priorities - and is restoration sign-off owned by clinical leadership? 

9. Are backups isolated from our identity plane, and have we restored critical clinical systems from them recently? 

10. Do pre-authorized playbooks exist for ambulance diversion, mass cancellation, and regional mutual aid? 

11. Are breach-notification decision procedures (HIPAA 60-day clock, state AG) documented and legally owned? 

12. Can the board see a measurable trend in operational cyber risk, not just audit findings? 

If any answer is "no" or "we're not sure," the UNM incident has shown exactly what that uncertainty costs on a Monday morning. 

Conclusion: Cyber Resilience Must Protect Continuity of Care 

The UNM Health cyberattack will be remembered - fairly or not - for an image: the day New Mexico's only Level I trauma center turned ambulances away because of a computer problem. Whether the underlying event proves to be ransomware, data-theft extortion, or something stranger, the verified facts already carry the lessons: clinical availability is a cybersecurity outcome; identity infrastructure is the linchpin of the entire hospital; segmentation and drilled downtime procedures are what convert a potential catastrophe into a very bad day; and no hospital recovers alone. 

The organizations that learn from UNM won't be the ones that ask "were we targeted?" They'll be the ones that ask "how fast can we keep patients safe when it happens to us?" - and have a measured answer.