A ransomware group claims it breached University of New Mexico systems, allegedly affecting student, employee, and patient data including Social Security numbers. The university has not confirmed this breach. Affected individuals should monitor credit reports, consider a credit freeze, and watch for phishing attempts referencing the university while awaiting official confirmation.
| Company | University of New Mexico |
|---|---|
| Industry | Education |
| Data Types Exposed | Social Security Numbers, Patient Appointment Information, Research Information, Human Resources and Payroll Records, Student Records, Internal Emails, Electronic Health Record Rosters |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Delaware Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the University of New Mexico Data Breach?
A ransomware group has publicly claimed responsibility for a large-scale attack on the University of New Mexico. The claim appeared on the group’s extortion leak site. However, the university has not publicly confirmed this incident as of this writing.
According to the posted claim, attackers say they compromised a massive portion of the university’s technology environment. The group alleges it accessed both Active Directory forests, including systems tied to the main campus and the hospital sector. As a result, the claim suggests exposure across academic, administrative, and clinical operations alike.
Because this report originates from the attacker’s own claim rather than a university statement, key facts remain unverified. There is no confirmed timeline for when unauthorized access began or when it was discovered. Readers should treat the scope and details below as alleged until the university issues an official response.
At this stage, no independent forensic report has been made public. This means the full extent of any intrusion, if real, is still unknown. For now, this remains an unconfirmed claim of a University of New Mexico data breach rather than an established fact.
Who was affected?
The ransomware group’s post claims the incident touches nearly every population connected to the university. This reportedly includes students, employees, and patients tied to the university’s hospital sector. Because the hospital and main campus allegedly share compromised infrastructure, both academic and medical populations could be implicated.
The exact number of affected individuals has not been publicly disclosed. The attackers reference a figure of machines allegedly compromised, not a confirmed count of impacted people. Therefore, the true scale of affected individuals cannot be verified from the available information.
Given the university’s size, the population potentially touched by this claim could be broad. Students, faculty, staff, and patients across New Mexico and beyond may wonder if their data was involved. Until the university communicates directly, individuals cannot know with certainty whether they personally were affected.
What Information Was Potentially Exposed?
The attacker’s claim lists several categories of data it says were accessed. Because this is an unconfirmed claim and not a university-verified disclosure, these categories should be viewed cautiously. Still, for transparency, the alleged categories referenced in the claim are listed below.
- Student and employee personal information, including Social Security numbers
- Patient appointment and health-related information tied to the hospital sector
- Research information
- Human resources and payroll records
- Student records data
- Internal email communications
- Electronic health record system rosters
If any of these categories were genuinely accessed, the risks would be significant. Social Security numbers combined with names and birthdates can enable identity theft, fraudulent credit applications, and tax fraud. In addition, payroll and HR data could allow criminals to attempt fraudulent direct-deposit changes or impersonate employees.
Health-related information, if truly exposed, raises separate concerns. Medical identity theft can lead to fraudulent insurance claims or incorrect information appearing in someone’s medical history. Because this claim has not been verified, affected individuals should still prepare for these risks while awaiting official confirmation.
What is the company doing?
Because this incident is currently based on an attacker’s claim, there is no confirmed university statement describing an investigation or remediation steps. The University of New Mexico has not publicly confirmed the breach. As a result, no specific notification timeline or protective service offering tied to this particular claim has been announced.
Separately, public records show that an entity associated with the university, Pathward N.A., filed a formal data breach notification with the Delaware Attorney General in 2022. That filing relates to a distinct matter and should not be assumed to confirm or describe this specific ransomware claim.
Until the university issues its own statement, affected individuals should rely on official university communications rather than the attacker’s posted claims. If the university confirms the incident, it would typically be expected to notify affected individuals and may offer credit monitoring. For now, that remains speculative rather than confirmed.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Because Social Security numbers were allegedly included in this claim, affected individuals should check their credit reports regularly. You can request free reports from each of the three major credit bureaus. Reviewing these reports helps you catch new accounts or inquiries you did not authorize.
In addition, consider spacing out your free reports throughout the year for ongoing visibility. This way, you have a rolling view of your credit file rather than a single snapshot. If you notice unfamiliar activity, report it to the credit bureau immediately.
Consider a Fraud Alert or Credit Freeze
Given the alleged exposure of Social Security numbers, placing a fraud alert or credit freeze is a reasonable precaution. A fraud alert requires lenders to verify your identity before issuing new credit. A credit freeze goes further by blocking most access to your credit file entirely.
Both options are free and can be requested directly from the credit bureaus. Because freezes are more restrictive, you will need to lift them temporarily when applying for new credit yourself. Nevertheless, this extra step can meaningfully reduce the risk of fraudulent accounts being opened in your name.
Stay Alert for Phishing Attempts
Whenever a breach is claimed, scammers often follow with phishing emails or calls referencing the incident. Be cautious of messages asking you to confirm personal details or click unfamiliar links. Legitimate university communications will not typically ask for passwords or Social Security numbers by email.
Instead, verify any suspicious message by contacting the university directly through a known phone number or website. This simple habit prevents attackers from using a real incident as cover for a fake one. As a result, you reduce your chances of becoming a secondary victim of this situation.
Protect Health-Related Information
Because the claim references hospital and patient-related systems, individuals connected to the university’s healthcare operations should watch for unusual insurance activity. Review your explanation of benefits statements for services you did not receive. Unexpected claims can be a sign of medical identity theft.
If you notice anything unfamiliar, contact your insurance provider promptly to dispute it. You may also request a copy of your medical records to check for inaccuracies. Catching discrepancies early makes them easier to correct before they cause lasting problems.
Consider Consulting a Data Breach Attorney
If the University of New Mexico eventually confirms this incident, affected individuals may want to understand their legal options. A data breach attorney can review the facts of your situation during a free consultation. This can help you understand whether you may be eligible to join a class action or seek compensation.
Because laws and deadlines vary by state, timing matters if you decide to pursue a claim. Consulting an attorney early preserves your options as more facts become public. In the meantime, keeping records of any suspicious activity will support a stronger claim later.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification report (PDF) from Delaware Attorney General
Related Data Breaches
- Summit School District Data Breach Exposes Social Security Numbers and Financial Account Information
- Coastal Alabama Community College Data Breach Claim: Student and Employee Records Reportedly Exposed
- Research Foundation of The City University of New York Data Breach Claim: Personal Information Reportedly Exposed