Patients, students and employees of the University of New Mexico Health Sciences Center were caught up in an October 26, 2026 cyberattack that diverted ambulances and canceled a day of appointments. A group calling itself Byod claims it took their personal data; UNM says core systems were not penetrated, no notices have gone out, and there is nothing to claim.
Data Theft Unconfirmed · No Suit Filed · Nothing to Claim
The data theft described below is claimed by the group that says it carried out the attack. UNM has not confirmed that any personal data was taken, no notice letters have been sent, no lawsuit has been filed and there is nothing to claim. This page is informational and is not legal advice.
What Happened?
Information technology teams at the University of New Mexico Health Sciences Center began containing what UNM called a “cybersecurity threat” at about 11 a.m. on Monday, October 26, 2026. Staff were told to shut down and unplug their computers and switch to paper. From 12:30 to 2:30 p.m., UNM Health diverted ambulance traffic to other area hospitals, and it canceled all outpatient surgeries and clinic appointments for the rest of the day. UNM Hospital is New Mexico’s only Level I trauma center.The attack touched the entire Health Sciences Center, according to UNM. Classes were canceled Monday afternoon and all day Tuesday, including online classes, at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health. UNM’s main and branch campuses were not affected, the university said.
UNM brought systems back in phases. By Tuesday afternoon its hospitals were fully open, ambulance traffic was back to normal and clinics had resumed scheduled appointments. Classes and research resumed Wednesday, October 28.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What the Hackers Claim
A group calling itself Byod listed UNM on its leak site on October 26. BleepingComputer reported that the group claimed to have compromised 36,000 systems across UNM’s hospitals and main campus, including its Microsoft account systems and its HR and payroll databases. Byod claimed it holds:- Social Security numbers and other personal data of students and employees
- Payroll and HR records, and student records
- Internal emails and research data
- Patient information and hospital appointment data
On October 27, Byod posted that it had not known it was locking machines used for patient care. It offered the hospital a free decryption key, said it would keep the data, and offered patients up to $2,500 each if they sent it proof that they were affected. UNM responded with a warning that “those responsible may attempt to exploit individuals through additional scams, including false offers of payments or compensation,” and asked the public not to respond to or engage with anyone claiming responsibility.
Byod is a new group, first seen in early October 2026, with a short list of claimed victims. Its claims about other targets have been partly verified in some cases and unsupported in others.
What UNM Says
UNM’s position is that the attack was narrower than Byod claims. In an October 27 update, the university said its assessment “determined that the event affected some end-user devices but did not penetrate core systems or servers,” and that it had notified state and federal law enforcement. On October 28 it said it “did not make concessions with any group behind the threat.”UNM has not said whether any personal information was taken. On October 26 it acknowledged the event “may have impacted patients, employees and students.” Spokesperson Chris Ramirez told the Albuquerque Journal on October 28 that the system was waiting on an FBI forensic analysis: “When we complete a very thorough forensic analysis, we’ll have those answers.” He added that UNM’s statements are “factual and accurate despite what other groups may be claiming.” The Journal also reported that some employees were still being asked not to turn on their computers.
Will Patients, Students and Employees Be Notified?
Not yet. No notice letters, report to the U.S. Department of Health and Human Services or state notice had been published as of October 30. If the forensic review finds that patient information was taken, HIPAA gives UNM Health up to 60 days from discovering the breach to notify the people affected, which for an October 26 discovery runs to late December 2026. New Mexico’s own data breach notification law does not apply to state institutions or to HIPAA-covered entities, so the federal rules govern.UNM Health reported a different breach in 2021, in which an intruder had access to its network for about a month. That incident affected 637,252 people, according to the HHS breach portal, and exposed names, birth dates, medical record numbers, insurance and clinical information and, for some, Social Security numbers.
Has a Lawsuit Been Filed?
No lawsuit over the 2026 attack had been found in federal court records or news reports as of October 30. The law firm Chimicles Schwartz Kriner & Donaldson-Smith has posted that it is investigating the incident.A case against UNM would differ from the typical data breach class action against a private company. UNM is a state institution, and the New Mexico Tort Claims Act gives government bodies immunity from tort claims except in specific categories the Act waives. The Act also requires written notice of a claim against the state within 90 days of the occurrence, with some exceptions. No New Mexico appeals court decision applying the Act to a data breach claim was found. Whether any claim could proceed would depend first on whether personal data was in fact taken, which UNM has not confirmed.
What Happens Next
The FBI’s forensic analysis is expected to show whether personal data left UNM’s network. If it did, notice letters would follow, and OCA will update this page with who was affected, what was exposed and any lawsuit that is filed. Other data breach cases with open claims are listed on the data breach settlements page.Questions
Was patient data stolen in the UNM Health cyberattack?
It has not been confirmed. A group calling itself Byod claims it took patient information along with student and employee Social Security numbers and payroll records. UNM says the attack affected some end-user devices but did not penetrate core systems or servers, and a spokesperson said the answer depends on an FBI forensic analysis that was still under way as of October 29, 2026.
Has UNM Health sent data breach notice letters?
No notice letters or federal breach report had been published as of October 30, 2026. HIPAA gives a covered health system up to 60 days from discovering a breach of patient information to notify the people affected, which for an October 26 discovery runs to late December 2026.
Is there a class action over the UNM Health cyberattack?
No lawsuit had been found as of October 30, 2026. At least one law firm, Chimicles Schwartz Kriner & Donaldson-Smith, has posted that it is investigating. UNM is a state institution, so any claim against it would face the New Mexico Tort Claims Act, which limits suits against government bodies and sets a written-notice requirement.
Is the Byod offer of up to $2,500 to UNM patients real?
Byod posted that it would pay affected patients up to $2,500 if they sent it proof. UNM warned that those responsible may try to exploit people with false offers of payments or compensation and told the public not to respond to or engage with anyone claiming responsibility for the attack.
Sources
• UNM Health Sciences Center: Cybersecurity Incident Updates (October 26–28, 2026)• Albuquerque Journal: UNM Health Has Not Made Concessions to Hackers
• BleepingComputer: UNM Health Ransomware Attack Disrupts Patient Care
• HIPAA Journal: 2021 UNM Health Data Breach Affected More Than 637,000 Patients
