Byod Ransomware Group Claims Attack on UNM Health Sciences Center, Disrupting Surgeries and Ambulance Diversions at New Mexico's Only Level I Trauma Center

New Mexico's only Level I trauma center was forced to divert ambulances and suspend outpatient surgeries after a ransomware attack struck the University of New Mexico Health Sciences Center on October 26, 2026. A newly identified group calling itself Byod has claimed responsibility, alleging a scope of compromise that, if accurate, would rank among the most technically extensive attacks ever reported against an academic medical center.

This is a breach disclosure, not an OCR enforcement action. No fine has been announced.

What Happened

UNM Health Sciences Center began experiencing disruptions on October 26. The incident forced ambulance diversions away from UNM Hospital, which operates as the state's sole Level I trauma center, and led to the suspension of outpatient surgical procedures. Academic activity at the health sciences center was also disrupted. By October 27, clinics had resumed operations. UNM Hospital and Sandoval Regional Medical Center remained open and continued treating patients throughout the incident.

The ransomware group Byod, described as newly identified, publicly claimed responsibility for the attack. The group alleges it compromised roughly 36,000 machines, two Active Directory forests, the Microsoft Entra tenant, and two Oracle databases. The group further claims to have accessed data including Social Security numbers, HR records, payroll data, and clinical records. These figures and claims come from the group itself and have not been independently verified. Readers should treat the reported scope as alleged rather than confirmed.

Why the Claimed Infrastructure Access Matters

Most ransomware disclosures describe file encryption or exfiltration from a single environment. The Byod group's claims go further, alleging control over two separate Active Directory forests and the Microsoft Entra tenant. If accurate, that level of access means the attackers potentially held the keys to identity and authentication across the entire organization, including the ability to create accounts, escalate privileges, and persist undetected across hybrid cloud and on-premises systems.

For compliance officers, this framing matters because identity infrastructure compromise changes the recovery calculus. Restoring encrypted files is a discrete problem. Rebuilding trust in a compromised directory environment requires a different order of effort, including credential resets, token revocation, audit log forensics, and potential re-provisioning of connected systems.

HIPAA Obligations That Apply Now

UNM Health Sciences Center is a covered entity under HIPAA. The Breach Notification Rule establishes clear timelines and notice requirements that activate at the point of discovery, not at the conclusion of any investigation.

45 CFR §164.404 requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI.

45 CFR §164.408 requires notification to the Secretary of HHS. When a breach affects 500 or more individuals in a single state or jurisdiction, that notification must also occur within 60 days of discovery, and the covered entity must notify prominent media outlets serving the affected area.

45 CFR §164.406 covers the media notice requirement for large breaches in more detail. Given the reported scope of this incident, it is difficult to imagine a scenario in which fewer than 500 New Mexico residents are affected.

If any of the compromised systems involved business associates, those entities carry their own notification obligations to UNM Health Sciences Center under 45 CFR §164.410, with a 60-day discovery-to-notification window as well.

The content of individual notices must meet the requirements of 45 CFR §164.404(c), including a description of what happened, the types of information involved, steps individuals can take to protect themselves, what the covered entity is doing in response, and contact information for questions.

The Level I Trauma Center Dimension

The disruption of ambulance routing and surgical scheduling at a Level I trauma center raises stakes that go beyond data governance. Level I designation means UNM Hospital provides the highest level of surgical care for traumatic injury in the state. When ransomware forces diversions from that facility, patients with time-sensitive injuries travel farther, potentially to facilities with fewer resources.

This patient safety dimension is increasingly part of the regulatory and litigation landscape around healthcare ransomware. HHS and OCR have both signaled attention to cases where cyberattacks create foreseeable harm to patient care, not just data exposure. Compliance teams at similarly positioned institutions should treat this incident as a signal to test downtime procedures specifically for trauma and emergency service continuity.

What Compliance and Security Teams Should Do Now

This incident surfaces several concrete review items for compliance officers, practice managers, and healthcare technology leaders at other covered entities and business associates.

Audit identity infrastructure. The alleged compromise of Active Directory forests and a cloud identity tenant underscores that identity is now a primary attack surface in healthcare. Review privileged access controls, conditional access policies, and lateral movement protections across both on-premises and cloud environments.

Validate your ransomware response playbook. Does your organization have documented downtime procedures for clinical operations? Are those procedures tested, not just written? The ambulance diversion and surgical suspension at UNM illustrate what happens when ransomware meets a care delivery organization without tested manual fallback processes.

Confirm business associate agreement coverage. Any vendor with access to PHI or to systems that touch PHI is a potential vector and a potential notification obligation. Now is a good time to confirm your BAA inventory is current and that agreements include breach notification timelines consistent with 45 CFR §164.410.

Begin the breach notification clock. For UNM Health Sciences Center specifically, the 60-day notification window under the Breach Notification Rule began running at the point of discovery. Delayed investigation timelines do not extend the legal deadline. Outside counsel and compliance leadership should be coordinating on notification scope and timing immediately.

Engage state regulators proactively. New Mexico has its own data breach notification statute covering Social Security numbers and other personal identifiers. Compliance with HIPAA's federal requirements does not substitute for state law compliance. Both tracks need to run in parallel.

A Note on the Byod Group

Byod appears to be a newly identified ransomware group, meaning there is limited public threat intelligence on their tactics, prior victims, or reliability as a source of their own claims. The name itself may be a reference to the enterprise concept of bring-your-own-device, though that connection is speculative. Compliance teams should monitor threat intelligence feeds for additional reporting on this group as it emerges and coordinate with cybersecurity counsel or incident response partners who are tracking new ransomware actors.