UNM Health Cyberattack Disrupts Patient Care
UNM Health Services Disrupted by Cyberattack, Extortion Group Claims Data Theft
Related Entities
Threat Actors
Products & Tech
Other
Full Report
Executive Summary
On October 26, 2026, the University of New Mexico Health System (UNM Health) suffered a significant cyberattack that severely disrupted patient care at its facilities, including the state's only Level 1 trauma center. The incident forced the temporary diversion of all ambulance traffic and the cancellation of outpatient surgeries and appointments. A newly emerged cyber extortion group, "BYOD," has claimed responsibility, asserting it compromised 36,000 systems and exfiltrated large volumes of sensitive data, including patient health information (PHI), Social Security numbers, and university research. UNM Health has engaged law enforcement and cybersecurity partners and has since restored most critical services, but the event underscores the profound vulnerability of healthcare infrastructure to cyber threats.
Threat Overview
The attack was detected around 11:00 AM on Monday, October 26, prompting immediate containment measures, including shutting down computers and disabling Wi-Fi across the UNM Health clinical system. To manage the crisis, an Emergency Operations Center was activated. Between 12:30 PM and 2:30 PM, UNM Hospital, a critical care facility, diverted all ambulance traffic to other hospitals, a drastic measure given the nearest Level 1 trauma center is 400 miles away. All outpatient services for the day were canceled.
The threat actor, self-identified as "BYOD," made its claims on a data leak site. The group alleges a wide-ranging compromise across the university and hospital environments, claiming theft of data from Cerner EHR rosters, Oracle databases, and Microsoft Entra systems. During the attack, a synthetic voice message was reportedly broadcast on hospital computers, announcing the data theft and providing contact information for ransom negotiations, a tactic consistent with modern ransomware and extortion operations.
UNM officials have stated that the attack primarily affected end-user devices and that core systems and servers were not breached. A phased restoration began the evening of October 26, with critical systems reported back online by October 27. However, the disruption was significant enough to cancel classes at several of the university's health sciences colleges.
Technical Analysis
While specific technical details of the initial access vector have not been disclosed, the attack displays the hallmarks of a multifaceted extortion campaign. The threat actor's claims, if true, indicate a deep network compromise.
Attack Chain & TTPs (Assessed)
- Initial Access: Threat actors likely gained entry through a common vector in the healthcare industry, such as a phishing email (
T1566 - Phishing) or exploitation of an unpatched, internet-facing system (T1190 - Exploit Public-Facing Application). - Execution & Discovery: Once inside, the attackers likely used scripting tools to perform network reconnaissance (
T1057 - Process Discovery) to identify high-value targets like EHR databases and file servers. - Data Exfiltration: The core of the extortion plot involves data theft. The actors claim to have stolen vast amounts of data, likely using exfiltration over C2 channels (
T1041 - Exfiltration Over C2 Channel). - Impact: The final stage involved deploying a disruptive payload. The synthetic voice message suggests a component designed for psychological impact and to pressure the victim into paying. This could be part of a ransomware deployment (
T1486 - Data Encrypted for Impact) or a standalone extortion tactic.
Impact Assessment
The operational impact on UNM Health was immediate and severe. The two-hour diversion of ambulances from the state's only Level 1 trauma center created a significant risk to patient safety for those requiring urgent, specialized care. Canceling surgeries and clinical appointments results in direct revenue loss, patient care delays, and reputational damage.
If the data theft claims by BYOD are substantiated, UNM Health faces substantial regulatory and legal consequences. The exposure of patient PHI would constitute a major breach under HIPAA, potentially leading to significant fines, mandatory notifications to all affected individuals, and class-action lawsuits. The alleged theft of research data could also compromise years of academic work and intellectual property.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were mentioned in the source articles.
Cyber Observables — Hunting Hints
Security teams may want to hunt for the following patterns that could indicate related activity:
log_sourcepowershell.exe, cmd.exe, or wscript.exe originating from non-standard parent processes.network_traffic_patternevent_id4625 (An account failed to log on) for brute-force attempts and Event ID 4624 with unusual logon types on critical servers.file_namedocument.pdf.exe) or files in unusual locations like C:\Users\Public\.Detection & Response
- Network Monitoring: Implement robust network traffic analysis (
D3-NTA) to baseline normal traffic patterns from critical systems like EHR servers. Alert on significant deviations, especially large outbound transfers. - Endpoint Detection: Utilize an EDR solution to monitor for suspicious process chains, such as an Office application spawning a PowerShell script. Implement rules to detect credential dumping tools like Mimikatz.
- Log Analysis: Centralize and monitor logs from critical applications, domain controllers, and firewalls. Correlate login failures with successful logins from the same source IP to detect brute-forcing or password spraying.
- User Behavior Analysis: Employ User Behavior Analysis (
D3-UBA) to detect accounts accessing data or systems outside of their normal patterns, which could indicate account takeover.
Mitigation
- Network Segmentation: Implement strict network segmentation (
D3-NI) to isolate critical clinical systems (like EHRs and medical devices) from the general corporate network and the internet. This can contain the blast radius of an attack. - Data Backup & Recovery: Maintain immutable, offline backups of all critical data, including EHRs and financial records. Regularly test restoration procedures to ensure a swift recovery from a ransomware attack.
- Access Control: Enforce the principle of least privilege. Implement Privileged Account Management (
M1026) and require Multi-Factor Authentication (MFA) for all remote access and for access to critical systems. - Patch Management: Aggressively patch internet-facing systems and critical vulnerabilities, especially on VPNs, firewalls, and email gateways. (
D3-SU).
Timeline of Events
MITRE ATT&CK Mitigations
Maintain and test offline backups to ensure recovery from a ransomware or data destruction event.
Network Segmentation
Isolate critical clinical networks from general corporate networks to contain the spread of malware.
Train users to recognize and report phishing attempts, a common initial access vector in healthcare.
Multi-factor Authentication
Require MFA for all remote access and access to sensitive systems to prevent account takeover.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
In the context of the UNM Health breach, implementing Network Traffic Analysis (NTA) is crucial for detecting data exfiltration. Security teams should deploy NTA tools to establish a baseline of normal data flow patterns for critical assets, particularly the Cerner EHR and Oracle databases mentioned by the attackers. Configure alerts for any significant deviations, such as large data transfers from these servers to external IP addresses, especially outside of business hours. Given the extortion claims, it is vital to monitor for traffic patterns indicative of large-scale data staging and exfiltration, such as sustained high-volume outbound connections over common protocols like HTTPS, FTP, or even DNS. This technique would help identify a breach in progress, potentially before the final impact stage, allowing response teams to sever connections and isolate compromised systems.
User Behavior Analysis (UBA) can be instrumental in detecting compromised accounts used in attacks like the one on UNM Health. By creating profiles of normal user activity, UBA systems can flag anomalous behavior that suggests an account has been taken over. For example, if a clinician's account, which normally only accesses patient records during work hours from a specific workstation, suddenly begins accessing thousands of records from a different subnet or attempts to access administrative systems, the UBA tool should generate a high-fidelity alert. This is particularly relevant given the attackers' claim of compromising 36,000 systems, which implies widespread credential compromise. Integrating UBA with the SIEM allows for correlation with other events, providing context and helping security analysts quickly identify and disable compromised accounts to halt lateral movement and data theft.
To prevent a recurrence of an incident with such wide operational impact, UNM Health should prioritize Network Isolation. This involves creating strictly enforced boundaries between different parts of the network. For instance, the clinical network containing sensitive medical devices and EHR access points should be logically and physically separated from the administrative/corporate network and the academic network. Access between these segments should be denied by default and only permitted for specific, justified protocols and sources. In this attack, had the initial compromise occurred on an administrative or academic machine, proper isolation would have prevented the threat actor from moving laterally to disrupt clinical operations and access patient data. This 'containment by design' is a foundational control for limiting the blast radius of any intrusion.
Timeline of Events
Cybersecurity incident detected at UNM Health Sciences Center.
Staff instructed to shut down computers and disable Wi-Fi.
UNM Health begins a two-hour diversion of all ambulance traffic.
Ambulance diversion ends.
Phased restoration of systems begins.
UNM Health announces critical systems are back online and normal operations have resumed.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.