healthcare-sector-threatransomware-group-operationoperational-disruption

BYOD Claims UNM Hospital Attack, Offers Decryption and Up to $2,500 to Patients

Sector Threat Intelligence · 4 sources · Updated 4d ago · First seen Nov 3, 2026

The cybercriminal group BYOD claimed responsibility for a ransomware attack on University of New Mexico Hospital, then apologized and offered to decrypt affected systems, saying it had not realized some machines supported real-time patient care. The group also offered affected patients up to $2,500 each upon receiving proof of impact. The available reporting does not establish that any payments were made or that systems were restored.

Despite the apology, BYOD said it would retain the data it had taken, leaving a potential confidentiality risk even if decryption proceeds. In a follow-up statement to DataBreaches, the group accepted responsibility for its actions but disputed some claims attributed to UNM; the supplied excerpt does not identify the specific disputed claims. DataBreaches described the patient-compensation offer as unprecedented in its more than 20 years of breach coverage, distinguishing it from previous hospital attacks in which criminals offered free decryptors and dropped ransom demands.

Who's targeting your sector?See the actors and campaigns active against you right now.

See sector threats

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Oct 26, 2026

Reported Nov 3, 20266d ago
BYOD disputes some UNM claims in response to DataBreaches inquiry
After DataBreaches contacted BYOD by email, the group provided a further statement accepting responsibility for its actions while disputing some claims made by UNM and repeated in media coverage. The available excerpt does not specify which claims the group disputed.
Hackers hit UNM hospital, then apologize and offer patients $2,500. In a new statement, they reveal more about the incident. - DataBreaches.Net
Reported Nov 3, 20266d ago
BYOD apologizes and offers decryption and up to $2,500 per affected patient
The day after the attack, BYOD offered to decrypt the locked systems, saying it had not realized some supported real-time patient care. The group offered affected patients up to $2,500 each upon proof of impact, but said it would retain the stolen data; no payments were confirmed.
Hackers hit UNM hospital, then apologize and offer patients $2,500. In a new statement, they reveal more about the incident. - DataBreaches.Net
Reported Nov 3, 20266d ago
BYOD claims responsibility for ransomware attack on UNM Hospital
A cybercriminal group calling itself BYOD claimed responsibility for an attack on the University of New Mexico Hospital that locked hospital systems.
Hackers hit UNM hospital, then apologize and offer patients $2,500. In a new statement, they reveal more about the incident. - DataBreaches.Net
Oct 26, 202615d ago
UNM Health diverts ambulances and cancels care during cyber incident
On October 26, 2026, a cybersecurity incident forced UNM Health to divert ambulances, cancel appointments across more than 30 clinics, suspend outpatient surgeries, and temporarily halt new patient intake. UNM activated an Emergency Operations Center, engaged outside support, and notified law enforcement; hospitals, ambulance services, and clinics returned to normal operations on October 27.
UNM Health Shuts Clinics and Diverts Patients During Security Incident

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

BYOD

Organizations

4 linked

University of New Mexico HospitalUniversity of New MexicoUniversity of New Mexico Health Sciences CenterUniversity of New Mexico Health System

Breaches

1 linked

UNIVERSITYOFNEWMEXICOHOSPITAL-2026-11

Do you run this?See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.

See Your Sector's Threats

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Security AffairsNews · Nov 5, 2026

UNM Health Shuts Clinics and Diverts Patients During Security IncidentOpen source ↗

Malware NewsNews · Nov 3, 2026

Hackers hit UNM hospital, then apologize and offer patients $2,500. In a new statement, they reveal more about the incident - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Data BreachesNews · Nov 3, 2026

Hackers hit UNM hospital, then apologize and offer patients $2,500. In a new statement, they reveal more about the incident. - DataBreaches.NetOpen source ↗

UnclassifiedNews · Nov 3, 2026

Hackers hit UNM hospital, then apologize and offer patients $2,500. In a new statement, they reveal more about the incident. - DataBreaches.NetOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News