INCIDENT REPORT · CP-2026-007

UNM Health cyberattack and ambulance diversion

L2 · GUARDEDREPORTED

A cyberattack on the University of New Mexico's health system led it to divert ambulances, limit admissions and suspend outpatient surgeries and appointments; a new group called Byod claimed a ransomware attack.

Incident ID: CP-2026-007
Incident date: 26 OCT 2026
Detection date: 26 OCT 2026
Affected countries: United States
Plotted location: Albuquerque, New Mexico, United States (Affected organization headquarters)
Threat classification: Level 2 — GUARDED
Classification rationale: Brief but acute disruption to emergency care at a major regional health system.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Healthcare, Education
Critical infrastructure: Yes
Organizations affected: University of New Mexico Health System, University of New Mexico Health Sciences Center
Operational consequences: Ambulance traffic was diverted and outpatient services suspended until critical systems returned in the early hours of 27 October. UNM said the incident affected end-user devices but did not penetrate core systems, and has not confirmed ransomware or Byod's data-theft claims.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Claimed by the Byod group; not confirmed by UNM

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

UNM Health cyberattack and ambulance diversion

L2 · GUARDEDREPORTED

Incident ID

CP-2026-007

Incident date

26 OCT 2026

Detection date

26 OCT 2026

Affected countries

United States

Plotted location

Albuquerque, New Mexico, United States (Affected organization headquarters)

Threat classification

Level 2 — GUARDED

Classification rationale

Brief but acute disruption to emergency care at a major regional health system.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Healthcare, Education

Critical infrastructure

Yes

Organizations affected

University of New Mexico Health System, University of New Mexico Health Sciences Center

Operational consequences

Ambulance traffic was diverted and outpatient services suspended until critical systems returned in the early hours of 27 October. UNM said the incident affected end-user devices but did not penetrate core systems, and has not confirmed ransomware or Byod's data-theft claims.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Claimed by the Byod group; not confirmed by UNM