Breaches

BYOD gang claims UNM Health attack that diverted ambulances

BYOD claims 36,000 machines in the UNM Health attack that cancelled surgeries; the hospital disputes it. What NHS trusts should learn.

Warning symbol graphic with the headline Ransomware gang claims US hospital attack

A cyber attack on the University of New Mexico Health Sciences Center cancelled a day of surgeries and sent ambulances elsewhere for two hours, and a little-known gang called BYOD now says it took over 36,000 machines. UNM Health disputes that and says the FBI’s forensic work will show whether patient data was taken, but the incident is already a useful rehearsal for NHS trusts.

What happened

The University of New Mexico Health Sciences Center (UNM HSC) found the attack on the morning of Monday 26 October 2026. It cancelled every appointment and outpatient operation for the rest of the day, and for about two hours emergency arrivals went to other hospitals in Albuquerque and Santa Fe. UNM Health runs New Mexico’s only burn unit, its only children’s hospital and its only Level 1 trauma centre, and handles more than a million patient visits a year.

Staff were sent a phone alert telling them to unplug desktop computers and take mobile devices off the hospital Wi-Fi. Services came back in stages from mid-afternoon, and by late Monday UNM said its hospitals had reopened and clinics would run normally on Tuesday 27 October. Health sciences classes, online sessions included, were cancelled on Tuesday and non-essential staff stayed at home.

On Monday evening a ransomware group calling itself BYOD put the University of New Mexico on its leak site. It claimed to have compromised 36,000 machines across the hospitals and main campus, and to hold personal data on students, staff and patients, including payroll records, internal email and appointment information. None of these claims has been independently verified. According to The Record, BYOD only emerged last month.

On Wednesday 28 October UNM Health said it had made no concessions to the attackers. In a release the day before, it said technicians had found that the intrusion “affected some end-user devices but did not penetrate core systems or servers”. Spokesperson Chris Ramirez told reporters at a Wednesday news conference, reported by the Albuquerque Journal, that the organisation still did not know whether patient data had been taken, and that the FBI was carrying out a forensic analysis as part of a criminal investigation. He would not say whether UNM had been in contact with BYOD, which, according to BleepingComputer, said it would remove its listing after UNM opened communication.

The technical picture

UNM has not said how the attackers got in, has not confirmed that ransomware was used and has not published any indicators of compromise. The response itself is the main clue.

The decision to have staff power down and unplug desktops, and to pull mobile devices off the clinical wireless network, is a recognisable containment step. You take it when you think something is moving between endpoints and you cannot yet trust your own tools to stop it. That fits UNM’s statement that only end-user devices were hit, and its admission that two days later some staff were still being asked not to switch their computers on.

The gap between the two accounts is large. BYOD talks about the “entire network” and tens of thousands of machines, while UNM talks about a subset of endpoints and untouched servers. A gang with domain-level access can hit thousands of workstations without touching a clinical database, and stealing from file shares or mailboxes needs no core systems at all. Equally, new groups often inflate their numbers to build pressure. Until the forensics are finished, the scale of any data theft is unknown.

Timeline of the UNM Health cyber attack from discovery on 26 October to the 28 October statement

Why it matters for UK organisations

In June 2024 a Qilin ransomware attack on Synnovis, the pathology partnership serving several south-east London trusts, forced hospitals to cancel operations and turn patients away. Synnovis did not pay, rebuilt its infrastructure and only restored all services late that year. It later confirmed that names, dates of birth, NHS numbers and some test results were in the roughly 400 gigabytes the gang published, a finding that took more than a year to establish.

The UNM case holds three lessons for UK trusts, medical schools and their suppliers. First, a short diversion only works if the decision has been rehearsed and neighbouring providers have agreed in advance to absorb the patients. Second, the gap between a gang’s claims and the victim’s findings creates its own operational problem. Patients and staff will often hear the attacker’s version first, and UNM’s warning not to engage with anyone claiming responsibility is something NHS communications teams should have drafted already. Third, combined academic and clinical estates such as UNM HSC, where a teaching campus shares infrastructure with hospitals, are hard to segment, and UK teaching trusts share that structure.

There is a regulatory angle too. A UK organisation in UNM’s position would have 72 hours from becoming aware of a personal data breach to notify the ICO under UK GDPR, alongside NHS reporting through the Data Security and Protection Toolkit, probably before the forensics were complete.

Expert view

When we run ransomware simulations with healthcare clients, the technical containment is rarely what goes wrong. It is the hour before it. Someone has to tell a whole hospital to turn off its computers, with the authority and confidence that clinical teams can carry on using paper. UNM appears to have made that call quickly and reopened within hours, which deserves credit.

I would be careful about either side’s numbers at this stage. Leak site posts are criminal marketing, and early victim statements come before the forensics. In my experience, a claim that core systems were untouched often holds up for clinical platforms but turns out to be more complicated for email, file shares and HR data. That is precisely the material BYOD says it has. UK boards should ask whether they could tell regulators and patients anything accurate within days.

What to do now

  1. Rehearse the shutdown decision. Name who can order an estate-wide endpoint power-down or network isolation and test it in a tabletop exercise with clinical leads.
  2. Agree diversion and mutual aid in advance. Confirm with neighbouring trusts and ambulance services how patients will be redirected if your systems go dark.
  3. Segment teaching, research and clinical networks. Keep academic endpoints apart from clinical systems, in line with the Cyber Essentials firewall and secure configuration controls.
  4. Lock down privileged access. Enforce MFA on all remote and administrative access, remove standing domain admin rights and alert on mass software deployment from management tools.
  5. Keep offline, tested backups and paper fallbacks. Ensure appointments, prescribing and results can run without IT for at least a shift.
  6. Prepare scam and impersonation messaging. Draft warnings for patients and staff about follow-on scams, ready to publish within hours.
  7. Pre-plan regulatory reporting. Map ICO and DSPT notification steps so you can report on time even when the scope of data theft is still uncertain.

Bottom line

UNM Health’s attack cost a regional trauma centre a day of planned care and is now a dispute over how deep the intruders went. BYOD’s claims remain unverified, and the FBI’s forensic analysis will decide which version holds. For NHS trusts the lesson does not depend on that outcome: the shutdown call, the diversion plan and the communications all need to be rehearsed before the attack, not during it.

Sources

Related Posts