Ransomware Attack Disrupts UNM Health Hospitals, Threat Group Claims Theft of Student and Employee Data

What happened

On Monday, October 26 2026, UNM Health Sciences Center detected a cybersecurity issue at 11:30 a.m. MDT. Staff were instructed to shut down and unplug computers within 40 minutes, leading to the diversion of ambulances, cancellation of all clinic appointments, and a temporary halt to hospital operations. External partners and law‑enforcement were engaged, and systems were restored in phases later that day. A threat group later broadcast a synthetic voice message claiming theft of student and employee personally identifiable information—including SSNs, private documents, and email—and demanded ransom via an encrypted channel. UNM HSC confirmed the investigation remains active and details are limited.

Why it matters for trust and compliance

• The breach tests the effectiveness of incident‑response and recovery controls; organizations must retain defensible evidence of detection, containment, and stakeholder communication to satisfy audit and trust requirements.
• Demonstrates the need for continuous monitoring and evidence collection of incident‑response activities.
• Supports audit readiness by mapping response actions to control objectives across frameworks.

Who is affected

Recommended actions

1. Review and rehearse your incident‑response plan, ensuring clear escalation and communication steps.
2. Verify that logging, forensic data retention, and encryption controls are in place and auditable.