UNM Health cyber incident (Oct 26, 2026) diverts ambulances and cancels clinics; ransomware group BYOD claims compromise of "36,000 machines"
Event summary
On October 26, 2026, UNM Health experienced a cybersecurity incident that forced ambulance diversions and cancelled clinical appointments. Regional New Mexico health systems reported coordinating to accept additional patients. A ransomware group calling itself BYOD publicly claimed to have compromised "36,000 machines" on the university’s campus and hospital; that claim is unverified in available reporting.
CHRONOS Wire · October 28 · Alert 1
Publication details
- Published
- Updated
- Revision
- r1
- Source
- UNM HSC Newsroom
Cliff Notes
- Material US healthcare cyber incident (Oct 26, 2026) with confirmed ambulance diversion and cancelled clinics; BYOD claims large compromise pending verification.
U.S. Impact
Current impact
Low
Confirmed short-term operational impacts (ambulance diversion, cancelled clinics) at a major New Mexico hospital/university health system.
Potential impact
Elevated
Potential for patient-data exposure, care-disruption and follow-on impacts to statewide emergency response and nearby health systems coordinating patient care.
- Impact type
- Direct
- Confidence
- High
U.S. Impact is an analytical assessment of the estimated current and potential effects on the United States. It is not a probability forecast.
ELI5: Plain-English Explanation
On October 26, 2026, UNM Health experienced a cybersecurity incident that forced ambulance diversions and cancelled clinic appointments; a ransomware group called BYOD claimed to have compromised "36,000 machines," but that claim has not been independently verified.
Why Urgent Level 4
Event affected a major hospital/university health system causing immediate patient-routing and care-disruption; early forensic findings or breach notifications could affect many patients and regional providers.
What Changed
Initial reports (Oct 26) confirmed ambulance diversions and cancelled clinics; a ransomware group (BYOD) subsequently claimed responsibility and alleged compromise of 36,000 machines — the actor's claim is unverified by UNM or law enforcement in the available reporting.
What Is Genuinely New
News and the UNM newsroom published contemporaneous reports confirming ambulance diversions and cancelled clinical appointments on Oct 26; separate reporting records a BYOD claim alleging compromise of 36,000 machines.
CHRONOS Bottom Line
A material cybersecurity incident on Oct 26 affected UNM Health operations (ambulance diversions, cancelled clinics); a ransomware group claims a large-scale compromise (36,000 machines) but attribution and scope remain unverified.
Uncertainties / Known Unknowns
Extent of technical compromise, whether data exfiltration occurred, and accuracy of BYOD's claim of "36,000 machines" compromised.
Detailed Analysis
On October 26, 2026 UNM Health publicly told patients not to come to facilities due to a cybersecurity issue; regional providers reported coordinating to accept additional patients. Subsequent reporting records a ransomware actor (BYOD) claiming compromise of 36,000 machines on campus and hospital systems. At this time, UNM and law enforcement have not publicly verified the actor's scope or data exfiltration claims in the sourced reporting.
Sources / Evidence
- 01
- 02A cybersecurity issue forces a major New Mexico hospital to divert patients and close clinicsAssociated Press2026-10-26
- 03University of New Mexico hospital diverts ambulances after cyber incidentThe Record (Recorded Future)2026-10-27
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.