Daniel Mercer
On Monday, around 11 a.m., the information technology teams at the University of New Mexico Health Sciences Center detected a significant cybersecurity threat and initiated containment measures. Between 12:30 and 2:30 p.m., the health system redirected ambulance traffic to other hospitals in Albuquerque and Santa Fe. Outpatient surgeries and appointments were canceled for the rest of the day as teams worked diligently to safeguard the network. It’s important to note that UNM Hospital serves as New Mexico’s only Level I trauma center.
The following afternoon, UNM Health Sciences Center officials provided an update revealing that critical electronic systems had been restored. The announcement confirmed, “All UNM Health hospitals are fully operational, ambulance traffic has resumed normal operations, and clinics have restarted their scheduled appointments and procedures.” The assessment indicated that while some end-user devices were impacted, core systems and servers remained secure. Teams collaborated with external partners to enhance network security and informed state and federal law enforcement agencies.
Classes at the UNM School of Medicine, College of Nursing, College of Pharmacy, and College of Population Health were canceled on Tuesday, with nonessential Health Sciences Center staff instructed to stay home. A subsequent update clarified, “Classes and research activities at the UNM Health Sciences Center resumed on Wednesday, and clinical operations across all UNM Health facilities are now fully operational.”
The incident is currently under criminal investigation, which may limit the information the university has made publicly available. Notably, UNM has not classified this event as a ransomware attack.
Hacker Group BYOD Takes Responsibility and Issues Apology
During this situation, a hacker collective known as BYOD listed the University of New Mexico on its data-leak website, which functions as a Tor hidden service. Their post alleged that 36,000 machines were compromised across both the main campus and the hospital sector, including two Oracle databases, Oracle HR and Payroll systems, student records, internal emails, electronic health record rosters, and various other data types. They also claimed to possess the personally identifiable information of every student and employee, including Social Security numbers.
According to a statement republished by Dark Web Informer, the listing asserted, “This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.”
On Tuesday, BYOD released an update offering free decryption keys specifically for the remaining locked devices within the hospital sector. The complete message read:
“We are offering the decryption key for the remaining locked devices for free (ONLY for the hospital sector). We did not realize that it was affecting machines related to assisting patients in real-time. We would have kept it locked if it solely involved appointments, patient information, and research data. We will retain the data but will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient impacted, please provide us proof, and we will compensate you up to $2,500 each for the inconvenience. We apologize once again. We have morals and a conscience; we are not villains but will continue to hold companies accountable for poor security that leads to the compromise of any customer data. That’s the primary reason for our existence, and we intend to uphold that.”
Following a cybersecurity incident, those responsible may attempt to exploit public concern through additional scams, including false offers of payments or compensation. pic.twitter.com/0nfSoRj3UB
— UNM Health Sciences (@UNMHSC) October 28, 2026
It remains unclear whether BYOD provided any decryption assistance that aided in restoring systems at the UNM Health Sciences Center. Gizmodo reached out to the center for a comment on this matter, but they did not respond before publication. The university’s public statements have not verified BYOD’s claims, leaving the full extent of the situation unconfirmed as of now.
The closest acknowledgment regarding BYOD came in a Wednesday update from UNM, which stated, “Following a cybersecurity incident, those responsible may attempt to exploit public concern through additional scams, including false offers of payments or compensation.”
The statement further asserted, “UNM did not negotiate with any group behind the threat.”
What is the BYOD Hacker Group?
BYOD is an emerging ransomware group that surfaced approximately a month ago. Reports from BleepingComputer indicate that their leak site currently lists six victims, including T-Mobile, and they have already published data they claim to have stolen from three of these organizations. The group describes its actions as a form of “pentesting,” aimed at exposing vulnerabilities and holding data controllers accountable.
One of their earlier targets was Trump Mobile, where BYOD shared a database containing what they claimed were 3,615 customer records. Journalists and security researchers later verified portions of this data as authentic. The leaked information included real names, email addresses, phone numbers, physical addresses, and order details. According to International Cyber Digest, records associated with Trump Organization Chief Information Officer Eric Brunnett and U.S. Congressman Mike Kelly were part of the data. BYOD alleged that the breach occurred after malware infected a device at partner company Liberty Mobile, claiming that Trump Mobile responded by stating it lacked a security team to manage the incident.
While public apologies and offers for free decryption keys from ransomware groups are rare, they are not entirely unheard of. In January 2023, the LockBit group issued a formal apology for an attack on Toronto’s Hospital for Sick Children after an affiliate violated internal rules against targeting medical facilities. LockBit claimed it had blocked the affiliate and released a free decryptor. The hospital subsequently stated it had not paid a ransom and was restoring systems from backups.
Other notable instances of similar conduct include Conti’s handling of the attack on Ireland’s Health Service Executive and TeslaCrypt’s release of a master key.
Ethan Carter
