A hacking gang that knocked out computers across New Mexico’s only Level I trauma centre has issued an extraordinary public apology, claiming it “did not know” the machines were being used to care for patients, and offering up to $2,500 to every patient affected. There is a catch: the hackers say they are keeping the data they claim to have stolen.
The University of New Mexico Health Sciences Center (HSC), which includes UNM Hospital in Albuquerque, was hit by what it called a cybersecurity event on Monday, 26 October. The university has said it made no concessions to the attackers and is warning people not to trust any offer of money.
Ambulances diverted, clinics shut
Officials identified the threat at around 11am local time on Monday, according to Dexerto. Local broadcaster KOB 4 reported that ambulance traffic was diverted and that UNM Health paused new patient intake between 12.30pm and 2.30pm, with other hospitals in Albuquerque and Santa Fe taking patients. Outpatient surgeries and appointments were suspended for the rest of the day, and staff and students not needed on site in the School of Medicine and the Colleges of Nursing, Pharmacy and Population Health were sent home.
A UNM Health spokesperson, Chris Ramirez, told patients not to attend its facilities that day, directing emergencies to 911. KOB 4 reported claims that a message appeared on staff computers demanding contact through the Session encrypted messaging app, and that some screens showed a red skull with a warning that the user had been compromised. Those claims have not been confirmed by officials.
By Tuesday afternoon, critical systems were back and all UNM Health hospitals were fully open. Classes in the affected health colleges resumed on Wednesday, 28 October.
The hackers’ bizarre U-turn
A newly emerged extortion group calling itself BYOD claimed responsibility and listed UNM on its leak site on Monday, according to DataBreach.com. It claimed to have compromised 36,000 machines and taken student and employee records, including US Social Security numbers. The university has not confirmed any of those claims.
On Tuesday the group posted an update apologising and saying it had not realised some systems helped patients in real time. It offered free decryption keys for locked devices in the hospital sector only, and said it would pay up to $2,500 to each affected patient who sent proof of being affected. But it also said it would keep the data and would continue to target organisations it accuses of poor security.
BYOD appeared only around a month ago and has listed about ten victims since early October, DataBreach.com reported. By Thursday its leak site was listed as unreachable and no UNM data had been posted publicly.
UNM: don’t fall for it
UNM said the incident affected some end-user devices but did not penetrate its core systems or servers. On Wednesday it said it had made no concessions to any group and warned that the attackers might pose as a source of payments or compensation, asking anyone contacted to report it to the FBI. Mr Ramirez later said the university still did not know whether patient data had been compromised, with the FBI carrying out forensic analysis, according to DataBreach.com. UNM has not publicly described the attack as ransomware.
Security experts have long warned that “compensation” offers from criminals can be a trap in themselves, a way to harvest more personal details or bank information from frightened victims.
Irish readers will remember the 2021 ransomware attack on the HSE, which crippled hospital IT systems nationwide for weeks. The New Mexico case shows hospitals remain a prime target, and that some gangs now try to manage their public image even while holding stolen data.
What happens next
The incident remains under criminal investigation. UNM has not issued a formal breach notice, and a US law firm has opened an investigation into possible class action claims, DataBreach.com reported. Whether BYOD actually supplied any decryption keys, or would ever pay anyone, has not been verified. Patients are being told to ignore any approach offering money and to report it.
Sources
- Dexerto: Hackers insist they have “morals” after hospital cyberattack and offer victims $2,500 (29 October 2026)
- DataBreach.com: “We Are Not Villains”: Ransomware Gang Behind UNM Hospital Attack Offers Free Decryption, but Keeps the Data (29 October 2026)
- KOB 4: UNM Health cybersecurity threat: Ambulances diverted, clinics closed, students sent home (26-27 October 2026)
Featured image: photo by Tasha Kostyuk on Unsplash.
Leave a Reply