Cyberattack Disrupts University of New Mexico Health System as Extortion Group Claims Massive Data Theft

The University of New Mexico Health Sciences Center (UNM HSC) is recovering from a cyberattack that disrupted hospital operations, forced ambulance diversions, canceled patient appointments, and suspended classes across multiple health-related programs.

UNM HSC, which operates New Mexico’s largest teaching hospital and the state's only Level 1 trauma center, announced the cybersecurity incident on Monday afternoon. As part of its initial response, the organization diverted ambulance traffic to other hospitals, canceled clinic appointments, and shut down affected systems while security teams worked to contain the attack. External incident response specialists were engaged, and state and federal law enforcement agencies were notified.

Later updates indicated that hospitals had resumed normal operations and clinic appointments would proceed as scheduled the following day. However, classes at the university’s schools of medicine, nursing, pharmacy, and other health sciences programs were canceled while investigators assessed the impact of the incident. University officials said restoration efforts would continue in phases and warned that some disruptions could persist while systems were brought back online.

According to internal communications, security teams detected the network intrusion at approximately 11:30 a.m. on Monday. Within an hour, healthcare staff were instructed to shut down and disconnect computer systems and disable wireless connectivity on mobile devices as a precaution. University officials have not disclosed how the attackers gained access or whether any systems were encrypted.

An extortion group known as BYOD has claimed responsibility for the attack and alleges it stole student records, employee data, personally identifiable information, Social Security numbers, internal emails, research data, human resources records, and healthcare-related information. The group further claims to have compromised tens of thousands of systems spanning both university and hospital environments. These claims have not been independently verified, and university officials have not confirmed the scope of any data theft.

The attackers reportedly delivered a synthetic voice message to hospital computers during the intrusion, directing administrators to establish contact through an encrypted messaging platform. The message warned that stolen information could be released publicly if negotiations did not take place.

UNM HSC stated that the investigation remains active and that details are limited because of the ongoing law enforcement response. Officials acknowledged that patients, employees, and students may have been affected and said additional updates will be provided as more information becomes available.