On Monday, Oct. 26, workstations at the University of New Mexico Health Sciences Center (UNM HSC) began doing something hospital computers should never do: playing a synthesized voice message. According to The Daily Lobo, UNM's student newspaper, the text-to-speech recording asked administrators to "immediately" contact the attackers on Session, an encrypted messaging service, and claimed they held student and employee data, including personal information and Social Security numbers. The Daily Lobo notes that the audio, first shared by KOB4, does not contain the full message as it was broadcast.
UNM has not confirmed that the message was genuine. A UNM Hospital physician told the paper their own computer played it. Later that day, the health system moved to emergency footing. Ambulances were diverted, clinic appointments were cancelled for the day, and staff were told to unplug their machines and switch to paper.
An extortion group calling itself BYOD has claimed responsibility on its leak site and described a breach of very large scale. UNM has not confirmed any of those claims.
How the Day Unfolded
Help Net Security reports, citing the message administrators sent to healthcare workers, that the breach was detected at about 11:30 a.m. Monday, and that staff were asked to shut down systems some 40 minutes later. The Daily Lobo puts the administrators' message at 12:07 p.m. Staff were told to power down and unplug desktop computers, disable Wi-Fi on mobile devices, and continue work on paper forms.
That is a blunt containment tactic. Pulling machines off the network can cut off an attacker's remote access and slow malware spreading between systems, though it also takes down the systems clinicians depend on. For a hospital, the trade-off is uncomfortable but familiar: paper charting for a few hours is generally preferable to an encrypted electronic health record (EHR) in the middle of a shift.
The operational effects were serious. In its official update, UNM HSC said all ambulance traffic was being diverted to other hospitals and all appointments at all clinics that day were cancelled. The Daily Lobo reports that ambulances were diverted from Sandoval Regional Medical Center (SRMC) as well as from UNM Hospital. UNM Health temporarily limited its acceptance of new patients between 12:30 and 2:30 p.m., suspended outpatient surgeries and appointments for the rest of the day, and began resuming operations in phases at 2:30 p.m.
The diversion matters well beyond Albuquerque. Help Net Security notes that the UNM Health System operates New Mexico's only Level 1 trauma center. When it diverts ambulances, seriously injured patients have to be taken to other hospitals; UNM thanked health systems in Albuquerque and Santa Fe for ensuring patients had a safe place to receive care.
UNM says its HSC information technology security teams immediately took steps to contain the event and protect the network, notified state and federal law enforcement, and engaged external partners to assist with the investigation. Leadership also activated an Emergency Operations Center. As of its 10:27 p.m. update, UNM Hospital and SRMC were open and clinics were set to resume Tuesday, Oct. 27. HSC classes were cancelled for Tuesday, and nonessential employees were asked to stay home. HSC academic and research units were to remain closed Tuesday.
UNM described the incident as an active law enforcement investigation and said it was limited in what it could share. The Daily Lobo reports that its questions about communication with the attackers and the extent to which student, faculty and patient information was compromised were not answered in time for publication.
What BYOD Claims
According to Help Net Security, BYOD, which it describes as a cyber extortion outfit, advertises alleged intrusions on a Tor leak site, the anonymizing network that extortion crews use to publish victim lists and stolen files. The group's unverified claims include:
- Compromise of 36,000 machines across the UNM main campus and hospital environments;
- Access to two Oracle databases;
- Theft of student and employee personally identifiable information (PII), including Social Security numbers, plus research information and internal emails;
- Records from Oracle HR, payroll and Banner student records;
- Access to the university's entire Microsoft Entra tenant, the cloud identity directory behind sign-ins to Microsoft 365 and connected applications;
- Rosters from the Cerner electronic health record system.
None of these claims has been confirmed by UNM, and extortion groups routinely inflate what they have taken to pressure victims into paying. Still, the claims line up with the voice message described by The Daily Lobo, which also referred to student and employee data and SSNs.
One basic question is still open: whether this was ransomware. Help Net Security reports it is unclear whether the group also used ransomware to encrypt data on victims' systems. Some groups lock systems and steal data; others skip encryption and rely on the threat of a leak. UNM has not said which happened here. The hospital's shutdown is consistent with either scenario, since organizations often take systems offline as a precaution before they know whether encryption is under way.
The sources do not say how the attackers got in, how long they were inside before detection, or whether patient clinical records, as opposed to EHR rosters, were affected.
Why the Voice Message Stands Out
Many extortion crews make contact through a ransom note dropped on encrypted machines or an email to executives. Broadcasting audio through hospital workstations is a more theatrical approach. It tells everyone in the building, not just IT, that something is badly wrong, which raises pressure on leadership right away.
Being able to push a message to many workstations at once also suggests, though it does not prove, that the intruders had wide reach across managed endpoints. That is the kind of access that could come from administrative tooling or identity infrastructure rather than a single infected laptop. That reading would be consistent with BYOD's claim of Entra tenant access, but neither the claim nor the mechanism has been confirmed.
What It Means for Defenders
Who is affected. Directly, UNM HSC patients, students and employees. UNM itself said the event may have impacted patients, employees and students. If BYOD's claims hold up, current and former students and staff whose records sit in HR, payroll and student records systems could have had names and Social Security numbers exposed. UNM has not confirmed any data theft or said who might be notified. People in those groups should watch for official UNM notices and treat unexpected calls, texts or emails that cite the incident with suspicion, because scammers often exploit high-profile breaches.
No patch list, yet. The sources name no vulnerability, CVE or vendor flaw as the entry point, so there is no specific fixed version to install. Defenders should resist rumor-driven emergency patching and watch for any technical indicators that UNM, law enforcement or its outside partners release.
Lessons other hospitals and universities can apply now:
- Rehearse the 40-minute decision. According to the reporting, UNM moved from detection to an instruction to power down computers in roughly 40 minutes. Health systems should know in advance who has the authority to order that, how the order reaches every unit, and what clinical services can continue offline.
- Keep downtime procedures real. Paper forms, printed contact lists and ambulance diversion protocols only work if staff have practiced them. Test them on a schedule, not just after a peer is hit.
- Treat identity as crown-jewel infrastructure. The claimed Entra tenant access is unverified, but cloud identity compromise turns a breach into an organization-wide one. Review privileged role assignments, require phishing-resistant multifactor authentication for administrators, and alert on new app registrations, consent grants and changes to conditional access.
- Audit endpoint management reach. Any tool that can push software, scripts or messages to every workstation is also an attacker's best friend. Restrict who can use it, log its use and alert on unusual mass deployments.
- Segment and minimize sensitive records. HR, payroll and student systems that store SSNs should be segmented from general networks and monitored for bulk exports. Where SSNs are not needed, stop storing them.
- Engage law enforcement and outside responders early. UNM says it notified state and federal authorities and engaged external partners on the day of the event. Have those relationships and retainers in place before an incident.
For federal contractors and other organizations working through CMMC, the incident is a reminder that incident response, media protection and access control requirements are operational capabilities, not paperwork. The ability to isolate systems fast and keep critical functions running offline is what lets an organization limit disruption, though the full extent of the damage at UNM is not yet known.
ZeroDayFeed will update this story as UNM confirms what was accessed and whether notifications will follow.
