A ransomware group claims it stole student and employee data, research files, and internal emails from UNM Health Sciences Center after a cyberattack disrupted surgeries and ambulance routing in October 2026. UNM HSC has not confirmed the claim. Affected students, employees, and patients should monitor their credit reports and watch for phishing emails right away.
| Company | University of New Mexico Health Sciences Center |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Personally Identifiable Information, Research Data, Student Records, Internal Emails |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Delaware Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the University of New Mexico Health Sciences Center Data Breach?
The University of New Mexico Health Sciences Center, known as UNM HSC, experienced a disruptive cyber incident in October 2026. The disruption forced hospital staff to cancel surgeries and divert ambulances to other facilities. UNM Health told patients not to come to its facilities and urged people with emergencies to call 911 instead.
According to the timeline the university shared, the incident became apparent on a Monday afternoon in October 2026. As a result, all scheduled appointments and procedures for that day were canceled across UNM Health locations. By that evening, the university said hospitals had reopened and systems were coming back online in phases. However, classes at the Health Sciences campus, including the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health, remained canceled the following day as a precaution.
UNM HSC has not released details about how the intrusion occurred or who was behind it. A ransomware group has since claimed responsibility, posting on its leak site that it compromised a large number of machines across the university network. The group claimed to have taken student and employee personal information, research data, student records, and internal emails. Because this claim comes from the attacker rather than from UNM HSC itself, it has not been independently confirmed by the university, and the full scope of any data exfiltration remains unclear at this time.
Who was affected?
UNM HSC serves an enormous patient population, with more than one million patient visits recorded each year. This includes roughly 900,000 outpatient appointments and around 100,000 emergency room visits annually. Given this scale, the disruption likely affected patients who had surgeries or appointments scheduled during the outage window.
The incident also touched the university’s academic community. UNM HSC reported 2,670 students enrolled in its programs in 2025, and all of them were told to leave campus during the response. Employees across the Health Sciences campus were sent home as well, while non-essential staff remained off-site into the next day. The exact number of patients, students, or employees whose personal information may have been accessed has not been publicly disclosed.
Because the ransomware group’s claims reference both student and employee data, the population potentially affected could span multiple groups. This may include current students, faculty, staff, and patients who interacted with UNM Health facilities. Until UNM HSC confirms further details, the precise breakdown of affected individuals is not yet known.
What Information Was Potentially Exposed?
The ransomware group claiming responsibility for this incident alleges that it stole several categories of data from UNM’s network. These claims have not been verified by UNM HSC, so the following list reflects what the attacker says it obtained rather than confirmed fact.
- Student and employee personally identifiable information
- Research data
- Student records
- Internal emails
If these claims prove accurate, affected students and employees could face a heightened risk of identity theft. For example, personally identifiable information combined with internal records can allow scammers to impersonate victims or open fraudulent accounts. In addition, exposed emails often contain further personal details that criminals can use to craft convincing phishing attempts.
Research data theft carries its own risks beyond individual identity theft. Universities often hold valuable intellectual property, and its exposure could affect researchers and institutional partners. Meanwhile, anyone whose student records were accessed should remain alert for signs of targeted scams referencing their academic history, since this level of detail can make fraudulent messages appear more legitimate.
What is the company doing?
UNM Health responded quickly once the disruption began, canceling appointments and rerouting ambulances to protect patient safety. The university also brought systems back online in phases rather than all at once, a cautious approach meant to confirm each system was safe before restoring it. Staff worked to reschedule missed appointments and procedures as operations resumed.
As part of its remediation efforts, UNM canceled classes across several of its Health Sciences schools for more than one day. Non-essential employees were told to stay home while the university worked through its response. UNM HSC has not publicly confirmed the ransomware group’s claims about stolen data, and the university has not detailed the nature of the incident or named any attacker. UNM Health Sciences Center also filed a formal data breach notification with the Delaware Attorney General. Further updates are likely as the investigation continues.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone connected to UNM HSC, whether as a student, employee, or patient, should check their credit reports regularly in the coming months. You can request free reports from all three major credit bureaus and review them for accounts or inquiries you do not recognize.
This step matters because identity thieves often test stolen information before using it for larger fraud. Catching a small, unfamiliar entry early can prevent much bigger financial damage later. Consider setting a recurring reminder so you check consistently rather than just once.
Watch for Phishing Attempts
Because internal emails may have been accessed, affected individuals should be cautious about unexpected messages referencing UNM or university programs. Scammers sometimes use stolen email content to make phishing attempts look more authentic.
As a result, avoid clicking links or downloading attachments from unsolicited emails, even if they appear to come from a familiar university contact. Instead, verify any unusual request by contacting the sender directly through a known phone number or official website.
Consider a Credit Freeze or Fraud Alert
If you believe your personal information was part of this incident, placing a fraud alert or credit freeze with the credit bureaus adds an extra layer of protection. A freeze blocks new creditors from accessing your report, which makes it much harder for someone to open accounts in your name.
While a freeze requires a few extra steps when you apply for credit yourself, it is free and can be lifted temporarily when needed. Given the uncertainty around this incident, this precaution is a reasonable one for affected students and employees to take now rather than waiting for further confirmation.
Keep Records and Document Any Suspicious Activity
If you notice unusual account activity, unexpected mail, or suspicious calls referencing your university affiliation, write down the details right away. Keeping a clear record helps if you later need to dispute fraudulent charges or file a report with authorities.
In addition, saving any official communication from UNM HSC about this incident can help you track what the university has disclosed over time. This documentation may also prove useful if you decide to consult a data breach attorney about your options for a free case evaluation.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification report (PDF) from Delaware Attorney General