Hackers shut down a hospital's computers for one day, then apologized: 'We are not villains'

A cybersecurity incident disrupted operations across the University of New Mexico Health Sciences Center on October 26, forcing the health system to temporarily divert ambulances and suspend outpatient appointments. A ransomware group calling itself BYOD later claimed responsibility, alleging it had compromised thousands of systems and stolen sensitive data — claims UNM has not confirmed. A day later, the group issued an unusual apology and offered free decryption keys for hospital devices, while saying it intended to retain the data it claimed to have stolen, according to an October 26, 2026 report by KOB.

An ominous voice spoke up

On Monday morning, October 26, employees inside the University of New Mexico Hospital in Albuquerque were stunned to find that their computers were talking. According to a recording obtained by KOB, an automated voice broadcast on employee computers instructed administrators to contact the attackers through Session, an encrypted messaging app, before threatening to bring the university down "to the point of no operation, heavy lawsuits and risk of closure."

“Oh no, you have been compromised,” the voice said, and added, "We have all of your students' and employees' data, personally identifiable information and SSNs, private documents, emails, and much more." UNM officials had not confirmed the claims made in the message. By mid-afternoon Monday, a new extortion group calling itself BYOD had added the University of New Mexico to its Tor leak site. "This is your entire network and infrastructure compromised, the entire university COMPLETELY," the group wrote. It promised to take the post down once UNM "established communication," BleepingComputer reported.

Services were shut down

Around 11 am, the hospital’s IT security teams began containment, per UNM Health Sciences Center. At 12:07 pm, the staff got an alert about the network security breach. They were asked to unplug their desktops, turn off the Wi-Fi on their phones, and switch to paper forms, the Daily Lobo reported. Between 12:30 and 2:30, they directed their ambulances to other hospitals. According to the Associated Press, the disruption was especially significant because UNM Hospital houses New Mexico’s only Level I trauma center. But nearby health systems in Albuquerque and Santa Fe accepted diverted patients. In more than 30 clinics, the outpatient surgeries and appointments were cancelled. Patients were told not to come in. The classes within the university network were cancelled too.

What is BYOD?

BYOD is a new ransomware group that emerged about a month ago. According to BleepingComputer, the group’s leak site lists six victims so far, and it has already published data it claims to have stolen from three of them. The group has described its activity as a form of “pentesting” intended to expose vulnerabilities and hold data controllers accountable.

Plot twist

The situation was grim until it encountered a plot twist. About a day after claiming responsibility for the attack, the hackers apologized, offered free decryption keys, and also $2,500 per patient who suffered due to the glitch. The group claimed it had not realized some of the affected machines supported real-time patient care. "To any patient who was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again," the group said, per RansomLook. "We have morals, and we have a heart; we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data."

Operations return to normal

At about 2 pm on October 27, 2026, the hospital issued another notice on the website, announcing the opening of services: “All UNM Health hospitals are fully open, ambulance traffic has returned to normal operations, and clinics have resumed regularly scheduled appointments and procedures.” Howevr, UNM later warned patients and employees not to engage with groups claiming responsibility or offering payments, saying such offers could expose people to additional fraud. On October 29, 20206, UNM issued a notice on X, warning people, “Following a cybersecurity incident, those responsible may attempt to exploit public concern through additional scams, including false offers of payments or compensation.” The catch is, the gang is still keeping the data they hijacked from the computers.

Stakes are high

The stakes are high. UNM Hospital is the state's only Level I trauma center. The hospital network conducts about 900,000 outpatient visits and receives 100,000 emergency room visits each year, according to the US News. Approximately 60% of New Mexicans with cancer get treatment at UNM Comprehensive Cancer Center.

At present, the incident remains under criminal investigation, which may have “limited what the university has shared publicly.” UNM has not described the event as a ransomware attack, per Gizmodo.

More on Scoop Upworthy

She panicked when her account got hacked — until she realized the hacker had completed her physics homework

Man ‘hacked’ Amazon Prime's instant delivery — but only to help the homeless

This Janet Jackson song made laptops crash so often that it became a cybersecurity case