UNM Health Cyberattack: How Device Visibility Prevents…

On Monday, October 26, 2026, the University of New Mexico Health Sciences Center had a cybersecurity event that took New Mexico's only Level 1 trauma center off its normal footing for the afternoon.

UNM Health also runs the state's only burn unit and its only children's hospital. On Monday, ambulances went to other hospitals in Albuquerque and Santa Fe. All appointments and outpatient surgeries at more than 30 UNM Health clinics were canceled. From 12:30 to 2:30 p.m., UNM Health limited new patient intake while technicians rebooted the network.

Diversion doesn't stay inside one hospital. A 2023 JAMA Network Open study of a month-long ransomware attack in San Diego found that a neighboring emergency department saw more ambulance arrivals, longer waiting room times, and more patients leaving without being seen.

What we know so far

UNM Health hasn't said what kind of attack it was and points to an active law enforcement investigation. Its IT security teams moved to contain the event, and outside partners are helping with the investigation. Around 2:30 p.m. the system started bringing services back in phases, "as it was safe to do so." UNM Hospital and Sandoval Regional Medical Center are open, and clinics went back to regular appointments Tuesday. Health Sciences classes were canceled for a second day.

Staff also got a message. KOB obtained audio the attackers apparently pushed to hospital workers' computers, read in what sounded like a text-to-speech voice, claiming they had student and employee data including Social Security numbers.

On Monday, a new ransomware group called BYOD claimed the attack. It says it compromised 36,000 machines, both Active Directory forests, two Oracle databases, and personal data for every student and employee. None of that is verified. BYOD showed up last month with only a handful of named victims, and taking credit doesn't prove a group did the work or that it deployed ransomware.

We don't know how the attacker got in. This isn't a postmortem. But there are four points in this response where knowing exactly what's on the network matters.

1. Systems had to come down

UNM's teams shut down systems while they contained the event. The University of Mississippi Medical Center did the same in February, taking down all of its IT services after a ransomware attack.

Ordr discovers every connected device without agents, across IT, IoT, OT, and medical devices, and its Flow Genome maps the conversations each device has. Ordr describes one customer that used that context with Cisco ISE to isolate at-risk MRI machines within minutes after ransomware came in through a partner connection.

2. The attacker says it reached 36,000 machines

If BYOD's numbers are anywhere near right, the attacker reached tens of thousands of machines and the directory that controls them. CISA's #StopRansomware guide tells organizations to segment networks to restrict lateral movement from the first infected devices.

Ordr generates least-privilege segmentation policy from live traffic and pushes it to enforcement points the hospital already owns, including Cisco ISE, Cisco and third-party firewalls, and Meraki. Policy can be simulated against live traffic before it's enforced. An infusion pump gets the access an infusion pump needs. Nothing else.

3. A lot of devices can't run an agent

EDR covers laptops, workstations, and servers. Medical equipment, building automation systems, and OT controllers generally can't run an EDR agent. Those are blind spots.

Ordr is agentless. It builds a behavioral baseline for each device type and alerts on deviations: an unexpected protocol, an unusual destination, abnormal data volume. Through its Cisco ISE integration, Ordr can flag a compromised device to ISE to trigger quarantine.

4. Recovery happens in phases

UNM is bringing services back in phases. Someone has to decide what comes back first.

Ordr classifies medical devices separately from IT and IoT, maps what each device talks to, and records which devices deviated from their baseline. A recovery team can use that to decide what to check before it reconnects.

This keeps happening

UMMC, which also runs its state's only Level 1 trauma center, was hit by ransomware on February 19. It shut down every network system, including its electronic health records, and clinic appointments stayed canceled for more than a week. The Albuquerque Journal, citing a Comparitech report, put the average downtime for a healthcare organization after a cyberattack at 17 days. UNM Health started restoring operations the same afternoon.

It's also not UNM Health's first incident. In 2021, an unauthorized party got into its network on May 2 and wasn't discovered until June 4. The breach affected 637,252 patients. A month inside without anyone noticing is the gap behavioral baselining is meant to close.

The UNM Health cyberattack and where device visibility changes the outcome