UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
UNM Health Sciences Center, the academic medical arm of the University of New Mexico, suffered a cyberattack detected Monday 2026-10-26 around 11:30 a.m. Staff were told to shut down and unplug computers; ambulances were diverted, appointments canceled, and classes at health sciences schools suspended. Systems were restored in phases and hospitals reopened by October 27. During the attack, hackers played a synthetic voice message on hospital computers claiming theft of student and employee PII including SSNs, emails, and documents. The cyber extortion group BYOD claimed the intrusion on its Tor leak site, alleging compromise of 36,000 machines, two Oracle databases, the Entra tenant, Banner student records, HR/payroll, and Cerner EHR rosters; these claims remain unconfirmed, and ransomware use is unclear. State and federal law enforcement are investigating.
What to do
- Treat the incident as a likely large-scale PII breach; prepare identity-protection and notification processes for patients, employees, and students pending confirmation
- Hunt for attacker persistence across the Windows/Entra environment before trusting restored systems; rotate credentials, tokens, and service accounts
- Verify integrity of Oracle, Banner, and Cerner data and review access logs for exfiltration
- Monitor BYOD leak site for data publication and validate any claims against internal evidence
- Coordinate with law enforcement before public disclosure; preserve forensic evidence
Sources
All live incidents on Threat Watch
