Byod Ransomware Cripples UNM Health: 36,000 Systems Compromised, Surgeries Suspended
Executive Summary
In late October 2026, the University of New Mexico Health Sciences Center suffered a ransomware attack claimed by a newly emerged threat group called Byod. The attackers reported compromising 36,000 systems across UNM's campus and hospital environments, including Active Directory forests, Microsoft Entra tenants, and Oracle databases, while exfiltrating patient records, SSNs, HR and payroll data, and Cerner EHR rosters. The attack forced ambulance diversions, suspension of outpatient surgeries, class cancellations, and temporary halts to new patient admissions. UNM's IT teams, working with external partners, restored critical systems within roughly 24 hours, determining the attack impacted end-user devices but did not penetrate core servers.
This incident underscores a growing pattern of ransomware groups targeting academic medical centers, where converged IT and clinical networks create expansive attack surfaces. The Byod group's self-styled 'ethical hacker' framing—offering free decryption keys to healthcare facilities while retaining stolen data—signals an evolving ransomware playbook designed to maximize pressure while evading moral condemnation, a tactic security teams and executives must prepare for.
Why This Matters Now
Healthcare ransomware attacks are accelerating in 2026, with threat actors like Byod deliberately targeting institutions housing sensitive patient data across hybrid IT and clinical environments. Regulatory scrutiny under HIPAA is intensifying, and the convergence of academic, cloud, and hospital networks creates lateral movement pathways that traditional perimeter defenses cannot contain. Organizations without zero trust segmentation and east-west traffic controls remain critically exposed.
Attack Path Analysis
The Byod ransomware group likely gained initial access to UNM Health's environment through phishing or exploitation of exposed credentials, then escalated privileges by compromising Active Directory forests and Microsoft Entra tenant access. Attackers moved laterally across campus and hospital network segments, reaching Oracle databases and Cerner EHR systems, while maintaining command and control through covert channels before exfiltrating over 36,000 systems' worth of sensitive patient, HR, and research data. The attack culminated in ransomware deployment that disrupted patient care, diverted ambulances, and canceled surgeries across UNM Health facilities.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Byod ransomware actors likely gained initial access via phishing emails targeting UNM Health staff or by exploiting exposed VPN/remote access credentials or internet-facing services. The breadth of compromise across both university and hospital environments suggests credential-based entry rather than a single vulnerability exploit. A CNSF inline IPS with signature-based detection and cloud firewall (ACF) with FQDN filtering on inbound access points could have identified and blocked initial malicious traffic or unauthorized access attempts.
MITRE ATT&CK® Techniques
Valid Accounts
Data Encrypted for Impact
Command and Scripting Interpreter
Domain Policy Modification
OS Credential Dumping
Exfiltration Over C2 Channel
Service Stop
Account Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
HIPAA (Health Insurance Portability and Accountability Act) – Security Rule – Administrative, Physical, and Technical Safeguards
Control ID: 45 CFR § 164.306, 164.308, 164.312
NIST SP 800-53 Rev. 5 – Access Control, Incident Response, and System Recovery
Control ID: AC-2, AC-6, IR-4, SI-3, CP-10
NIS2 Directive (EU) 2022/2555 – Risk Management, Incident Handling, and Business Continuity
Control ID: Article 21 – Cybersecurity Risk Management Measures
CISA Zero Trust Maturity Model 2.0 – Identity Verification and Network Segmentation
Control ID: Identity Pillar – Pillar 2; Network Pillar – Pillar 3
PCI DSS 4.0 – Access Control, Audit Logging, and Incident Response Plan
Control ID: Requirement 7, Requirement 10, Requirement 12.10
DORA (Digital Operational Resilience Act) – EU Regulation 2022/2554 – Operational Resilience and ICT Incident Classification
Control ID: Article 11 – ICT Business Continuity; Article 17 – ICT-related Incident Management
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Ransomware attack disrupted surgeries, diverted ambulances, and exposed 36,000 systems including Cerner EHR and patient data, underscoring critical gaps in Zero Trust segmentation and east-west traffic controls under HIPAA.
Higher Education/Acadamia
Byod ransomware compromised UNM's Active Directory, Microsoft Entra tenant, and Banner student records, canceling classes and exposing SSNs, payroll, and research data across interconnected academic and clinical networks.
Government Administration
UNM Health's statewide public healthcare mandate and Level I trauma center disruption highlight ransomware risks to publicly administered health infrastructure requiring egress security, multicloud visibility, and NIST 800-53 compliance.
Information Technology/IT
Compromise of Active Directory forests, Group Policy, Oracle databases, and Entra tenant demonstrates urgent need for east-west traffic security, Zero Trust segmentation, and anomaly detection across hybrid IT environments.
Sources
- UNM Health ransomware attack disrupts patient care, surgerieshttps://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/Verified
- UNM Health Sciences Center Cybersecurity Incident Updatehttp://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hscVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- CISA #StopRansomware Advisorieshttps://www.cisa.gov/stopransomwareVerified
- HHS HC3 Healthcare Sector Ransomware Threat Landscapehttps://www.hhs.gov/sites/default/files/ransomware-trends-healthcare-sector.pdfVerified
- NVD - National Vulnerability Databasehttps://nvd.nist.gov/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to the UNM Health breach because attackers exploited flat network paths and uncontrolled egress to move freely across campus and hospital segments, exfiltrate data from over 36,000 systems, and deploy ransomware broadly. Had Zero Trust segmentation, east-west enforcement, and egress controls been in place, attacker reachability across clinical, research, and administrative environments would likely have been significantly reduced.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline inspection and FQDN-aware cloud firewall controls could likely reduce the reachability of malicious inbound traffic and limit unauthorized access attempts at network entry points before they establish a foothold.
Control: Zero Trust Segmentation
Mitigation: Identity-aware segmentation policies enforcing least-privilege access would likely constrain how far escalated credentials could traverse the environment, reducing the blast radius from any single compromised account across interconnected AD and Entra domains.
Control: East-West Traffic Security
Mitigation: East-west enforcement with workload-to-workload segmentation policies would likely reduce unrestricted inter-segment traversal, meaning attackers moving from a compromised endpoint toward Oracle databases or Cerner EHR systems would encounter policy boundaries that constrain their lateral reach.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across cloud and network paths would likely surface suspicious beaconing patterns or anomalous automation traffic earlier, reducing the window during which command and control activity could persist undetected across thousands of systems.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-based egress filtering and outbound traffic controls would likely constrain unauthorized data transfers toward external destinations, reducing the volume of sensitive data that could be moved out of the environment through unmonitored or unapproved outbound paths.
Had earlier segmentation and egress controls reduced attacker reachability across clinical and administrative zones, the ransomware deployment would likely have been confined to a smaller subset of systems, reducing the scope of operational disruption to patient care workflows and clinical scheduling.
Impact at a Glance
Affected Business Functions
- Electronic Health Records (EHR) - Cerner Platform Access
- Emergency and Trauma Services - Level I Trauma Center Operations
- Surgical and Outpatient Clinical Scheduling
- Academic Health Sciences Education and Research
Estimated downtime: 2 days
Estimated loss: N/A
Threat actor 'Byod' claimed exfiltration of data from approximately 36,000 compromised systems across UNM's campus and hospital environments. Allegedly stolen data categories include: Social Security Numbers (SSNs) of students and employees, HR and payroll records, Banner student information system records, internal email communications, academic research data, hospital appointment scheduling data, patient health information (PHI) from Cerner EHR rosters, and Microsoft Entra tenant identity data. If confirmed, this constitutes a large-scale breach of both HIPAA-regulated Protected Health Information (PHI) and FERPA-regulated student data. UNM Health serves over 1 million patient visits annually, suggesting potential PHI exposure at significant scale. UNM's own post-incident assessment stated that core systems and servers were not penetrated and the impact was limited to some end-user devices, which partially contradicts threat actor claims; the full scope of data exfiltration remains unverified.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy East-West Traffic Security controls to enforce workload-to-workload segmentation across hospital and campus network segments, preventing lateral movement from a single compromised endpoint from reaching EHR, Oracle, and AD systems (maps to ZTMM.Network, HIPAA.164.312(a)(2)(iv), NIST.800-53.SC-7).
- • Implement Zero Trust Segmentation with identity-based microsegmentation policies to enforce least-privilege access across Active Directory, Microsoft Entra, and critical clinical workloads, limiting privilege escalation blast radius and containing credential-based attacks (maps to ZTMM.Network, HIPAA.164.308(a)(3), NIST.800-53.AC-6).
- • Enable Egress Security and Policy Enforcement with FQDN-based outbound filtering and data loss prevention controls on all clinical and administrative network egress points to detect and block unauthorized data exfiltration to external destinations before sensitive patient and HR data can be staged or transferred (maps to ZTMM.Data, HIPAA.164.312(a)(1), NIST.800-53.SC-18).
- • Activate Multicloud Visibility and Control with centralized traffic observability and anomaly baselining across hybrid campus and cloud environments to detect covert C2 channels, suspicious automation, and anomalous east-west flows before ransomware staging completes (maps to ZTMM.CrossCutting.Visibility, HIPAA.164.312(b), NIST.800-53.AU-6).
- • Enforce Encrypted Traffic (HPE) controls with MACsec or IPsec for all data-in-transit across internal network segments and hybrid connectivity paths to ensure traffic is both protected from packet sniffing and inspectable for policy enforcement, closing covert exfiltration channels used during the Byod campaign (maps to ZTMM.Data, HIPAA.164.312(e)(1), NIST.CSF.PR.DS-2).
