Skip to content
HACKTECH
Ransomware & extortionReported Published 5 sources

Cyberattack claimed by BYOD gang forces UNM Health to divert ambulances

A cyberattack on the University of New Mexico Health Sciences Center on 26 October 2026 led UNM Health to divert ambulance traffic for two hours, suspend outpatient surgeries and appointments for the rest of the day, and cancel classes at four health sciences colleges the following day. UNM said the event affected some end-user devices but did not penetrate core systems or servers, that clinical operations were fully functional by 28 October, and that it did not make concessions with any group behind the threat. A new ransomware gang known as BYOD claimed the attack, and The Record later reported that the gang also claimed an incident at Michigan State University.

  • BYOD gang
  • UNM Health
  • healthcare
  • higher education
  • Michigan State University
  • ambulance diversion

What the sources report

  • UNM said IT security teams began containment around 11 a.m. on Monday 26 October 2026, and UNM Health diverted ambulance traffic to other area health systems from 12:30 to 2:30 p.m.
  • The Record, citing local news outlets, reported that employees received a phone alert telling them to turn off and unplug all desktops.
  • Outpatient surgeries and appointments were suspended for the rest of 26 October, and classes at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health were cancelled on 27 October; UNM said clinical operations were fully functional on 28 October.
  • UNM's assessment found the event 'affected some end-user devices but did not penetrate core systems or servers', and the university said it 'did not make concessions with any group behind the threat'.
  • According to The Record, BYOD claimed to have compromised 36,000 machines and stolen student, patient and employee data; The Record later reported the group said it would provide decryption keys for free and offered to destroy personal information for people who contacted it directly and paid $2,500.
  • UNM warned that those responsible may attempt further scams 'including false offers of payments or compensation' and asked anyone contacted to report it to the FBI's Internet Crime Complaint Center.
  • The Record reported on 2 November 2026 that BYOD had listed Michigan State University on its leak site, claiming personal information on 1.3 million current and former students; MSU said current evidence did not indicate a successful compromise of its central Active Directory environment.

What it means for your organisation

UNM said the event reached some end-user devices but not core systems or servers, yet ambulance diversion and suspended surgeries still followed. Restoring clinical operations by 28 October without concessions rested on decisions that can be rehearsed in advance: who may order devices isolated, how departments run during downtime and what patients and staff are told. The gang's direct offers to individuals also show that extortion pressure continues after systems are back online.

What we check

  • Test how quickly endpoints can be isolated or disconnected at scale, and who has authority to order it.
  • Review segmentation between general user devices and clinical, research and teaching systems.
  • Run a tabletop on ambulance diversion, downtime procedures and phased restoration for a hospital network.
  • Assess Active Directory hardening and the ability to force organisation-wide credential resets.
  • Check that patient, student and staff communications cover follow-up extortion contacts and fake payment offers.

Sources

Services that cover these checks

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works