UNM Health Reopens Clinics as BYOD Claims Ransomware Theft

Key Takeaways

• UNM Health clinics reopened Oct. 27 after a cybersecurity incident disrupted appointments and temporarily restricted new-patient access.
• BYOD claims it stole data from 36,000 machines, but that assertion has not been independently verified.
• The disruption highlights the concrete threats facing healthcare systems, including delayed patient care and locked clinical applications, even before the extent of a suspected breach is established.

UNM Health resumed clinic operations on Oct. 27 following a cybersecurity incident that interrupted appointments and temporarily limited the acceptance of new patients. The reopening restored an important part of the health system's operations, although the event's technical scope and potential data consequences remained unsettled.

An emerging ransomware group called BYOD has claimed responsibility. BYOD says it stole data from 36,000 machines connected to UNM, a substantial figure that would suggest broad access if verified. At this stage, however, the claim remains an allegation. It has not been independently confirmed, and UNM has not said that patient data was exposed.

That distinction matters. Ransomware groups commonly publish victim names and sweeping claims on leak sites to increase pressure during attempted extortion. Those posts can provide useful investigative leads, but they are not equivalent to forensic findings. Numbers may describe endpoints, files, records or compromised systems, and attackers do not necessarily explain which definition they are using.

UNM Hospital (UNMH) and the wider UNM Health environment also present a complicated recovery challenge. Healthcare networks connect clinical applications, administrative systems, laboratories, imaging equipment, academic resources and third-party services. A defensive shutdown in one area can therefore affect scheduling or classroom activity elsewhere, even when core patient-care systems remain available. Health sciences classes were still cancelled when clinics reopened.

Restoring appointments does not mean the investigation is finished. Recovery and forensic work often run in parallel. Security teams may need to rebuild devices, rotate credentials, inspect logs, validate backups and monitor for signs that an attacker retained access. At the same time, clinical leaders have to manage postponed visits and communicate with patients without getting ahead of verified evidence.

The broader numbers explain why the incident will receive attention beyond New Mexico. HHS OCR data reported by Becker's Hospital Review recorded 772 large healthcare breaches affecting at least 500 people in 2025, the highest annual total reported. Separately, at least 61.6 million individuals had protected health information exposed or impermissibly disclosed during 2025, according to BlackFog data and HHS OCR findings analyzed by HIPAA Journal. BlackFog's cross-industry dataset also placed healthcare first, with the sector accounting for 22% of 1,174 confirmed ransomware attacks.

Why does healthcare remain so attractive? Sensitive records can carry long-term value, while hospitals and clinics face intense pressure to restore disrupted services quickly. Clinical operations also depend on a mix of modern systems, specialized medical devices and older technology that may be difficult to patch or replace. Attackers know downtime has consequences beyond lost revenue.

Recent operations such as Gunra use double extortion, combining data theft with system encryption. ALPHV/BlackCat, associated with the 2024 Change Healthcare attack, demonstrated how a compromise affecting a key healthcare intermediary can produce disruption across pharmacies, providers and payment workflows. BYOD's UNM claim fits that pressure model, though attribution and impact still require confirmation.

For healthcare executives, the practical response extends beyond buying another security product. Internet-facing systems should be patched promptly, privileged access should be tightly controlled, and network segmentation can limit movement between administrative, academic and clinical environments. Immutable offline backups can help recovery, but they need regular restoration tests. Incident plans should also account for manual scheduling, patient communications, vendor dependencies and decisions about limiting new admissions or appointments.

That said, transparency has to follow evidence. UNM Health faces the familiar tension between providing timely public updates and avoiding premature conclusions about compromised data. The next meaningful disclosures will concern what systems BYOD accessed, whether information was removed, how many people may be affected and what notification obligations follow. Until then, the clinic reopening is a sign of operational progress, not a final measure of the incident's impact.