This is a new development in a story we reported earlier: University of New Mexico Health System diverts ambulances, closes clinics after cyber incident.
Key facts
- The Health Sciences Center warned employees, students, patients and community members not to respond to or engage with anyone claiming responsibility for the incident.
- The University of New Mexico Health Sciences Center assessed that some end-user devices were affected by the event but core systems and servers were not.
- The University of New Mexico Health Sciences Center said all healthcare facilities are fully functional after restoring systems, announcing this on Wednesday.
- The University of New Mexico Health System canceled appointments at more than 30 clinics and told people to avoid its main Albuquerque hospital on Monday.
All healthcare facilities were fully functional, the University of New Mexico Health Sciences Center said on Wednesday, after the center restored systems, marking a new development in the cyber attack that led to ambulance diversions and canceled medical school classes at its Albuquerque hospitals on Oct. 26. Other sources said systems returned by Tuesday, October 27, 2026.
About 40 minutes after the network breach was detected around 11:30 a.m. on Oct. 26, staff were asked to shut down and unplug computers. “At 2:30pm, UNM Health began resuming operations and bringing systems back online in phases, as it was safe to do so,” the health system said. More than 30 clinics had appointments canceled, people were told to avoid the main Albuquerque hospital, and the Health Sciences Center told its students to leave campus. Operations resumed in stages on Monday as the health system brought systems back online.
On Oct. 27, classes at the Health Sciences Center schools were still canceled, including online and remote classes, and the center told nonessential employees to stay home. The ransomware cartel calling itself BYOD claimed the attack on Monday evening. It said Tuesday the keys were free because it did not know the affected devices helped patients.
“the event affected some end-user devices but did not penetrate core systems or servers,” the Health Sciences Center said. Its security teams contained the event and also notified law enforcement and brought in external partners. University of New Mexico Health called the incident an active law enforcement investigation and said that limits what it can share.
The cartel said it compromised 36,000 machines on the main campus and at hospitals, including two Oracle databases. The cartel also claimed it accessed student and employee records, including Social Security numbers, payroll, Banner data, e-mail and Cerner electronic health record rosters. Administrators heard a voice message on staff computers telling them to contact the attackers through Session and claiming theft of student and employee information.
The cartel said it would keep stolen patient and employee data and destroy personal information only if people paid $2,500. It also said it would pay up to $2,500 per patient while keeping all stolen data.
University of New Mexico Health Sciences Center said it paid no ransom to the hackers. The center warned employees, students, patients and community members not to respond to or engage with anyone claiming responsibility for the incident, and the center also warned against clicking links, opening attachments or sharing personal or financial information because of identity theft, fraud and other malicious activity. The center said anyone contacted by hackers should keep the message, then report it to the FBI’s Internet Crime Complaint Center. Patients at University of New Mexico hospitals should remain alert to unsolicited messages and phishing attempts.
University of New Mexico Hospital in Albuquerque operates the state’s sole Level 1 trauma center, and serious injury patients had nowhere else to go in the state during the ambulance diversion. The Health Sciences Center is home to New Mexico’s only burn unit and children’s hospital, and it serves a large share of the uninsured population. Annually, the health system records roughly 900,000 outpatient visits, and emergency room visits reach 100,000 each year. Presbyterian Healthcare Services and Lovelace Health System said they coordinated with the University of New Mexico Health System and took more patients.
The incident affected only the Health Sciences Center, so classes on the University of New Mexico’s Central and branch campuses were not affected. Among the affected schools were the School of Medicine, College of Pharmacy, College of Nursing and College of Population Health. Enrollment at the Health Sciences Center reached 2,670 students in 2025.
University Hospitals in Cleveland, Ohio, had its systems disabled by hackers. Critical operations were unavailable through the weekend and into Monday, days before the New Mexico cyber attack. Federal and state governments acted after multiple attacks on health care facilities this year.
The Senate passed a bill earlier this month that expands federal cyber requirements for healthcare organizations. The White House rolled out Project Lifeline 250 on Monday, a six-month pilot that pairs rural hospitals with Microsoft, Cisco and Zscaler. Sean Cairncross, the White House National Cyber Director, said the program links American industry with rural hospitals and sends backup devices after incidents.
Josephine Wolff, a cybersecurity policy professor at Tufts University, said hospital incidents, including ransom demands, have happened for a decade. Wolff said breaching a system and playing a message on computers is unusual. “how much work we still have to do to get better at defending ourselves,” Wolff said.
Margot Cravens, an FBI spokesperson in Albuquerque, said the bureau was assisting its partner but would not comment further. The Associated Press reached out to the Bernalillo County Sheriff’s Office and the Albuquerque Police Department for comment.
Join the discussion