The BYOD group, which claimed the October 26, 2026 cyberattack on the University of New Mexico Health Sciences Center (UNM HSC), has posted an apology. It offers free decryption keys for the hospital’s devices and promises up to $2,500 to every affected patient who brings proof of harm. It keeps the stolen data, though, and the university has not confirmed any theft.
UNM HSC is the health arm of the state university in Albuquerque, and it includes the hospitals, the medical school and the biomedical research centers. It runs the only Level 1 trauma center, the only major burn center and the only children’s hospital in the state, and it serves a large share of residents without health insurance, as The Record reports. BYOD is a ransomware group (a gang that encrypts an organization’s systems and threatens to publish stolen data to get paid) that surfaced about a month ago. The name made headlines over the 3,615 Trump Mobile customer records, and it has nothing to do with the “bring your own device” workplace policy the acronym usually stands for.
What happened at the UNM hospital on Monday, October 26
HSC’s security team spotted the threat around 11 a.m. local time (MDT) on Monday and began containment right away. Between 12:30 and 2:30 p.m., ambulances were diverted to other hospitals in Albuquerque and Santa Fe, while outpatient procedures and visits were suspended for the rest of the day. Dozens of appointments fell through
On Tuesday, classes were also canceled at the medical school and in the nursing, pharmacy and public health programs, and nonessential staff were told to stay home, as The Register reports. In the afternoon the university announced that critical electronic systems were back online, the hospitals were fully open and ambulance traffic had returned to normal. On Wednesday, October 28, clinical, teaching and research operations resumed in full.
The university has kept its description of the incident dry. It calls it a “cybersecurity event,” never names ransomware, and says the assessment found some end-user devices affected, with no impact on core systems or servers. State and federal police were notified, the investigation is criminal, and no ransom was paid for HSC.
What does BYOD promise UNM hospital patients?
BYOD promises to hand over free decryption keys for the hospital-side devices that are still locked, and to pay up to $2,500 to every affected patient who proves the harm. The group says it intends to keep the stolen data, and none of this has been verified.
The message appeared on Tuesday, October 27 on the site where the gang lists its victims, under the title “UPDATE: UNM,” and it is archived on RansomLook. The group writes that it did not know those systems ran machines used to help patients in real time, and adds that it would have left everything locked had it been only appointments, patient information and research data. The keys work “only for the hospital sector,” and the data stays in its hands. Contact runs through the messaging app Session. The closing lines carry the apology, with the sentence “We have morals and we have a heart,” and a claim to a role. The gang says it wants to keep holding companies accountable for the weak security that leads to customer data being compromised.
Hackers who carried out a cyberattack on a hospital have apologized and offered the patients up to $2,500 each
The group said they have “morals” and didn’t realize they targeted machines helping people in real time https://t.co/tHHwGsShZY
— Dexerto (@Dexerto) October 31, 2026
The offer to patients has a single condition, proof of harm, and no other detail. The text does not explain how to prove it, who would assess it, in what currency or by what means the payment would arrive. The $2,500 figure is a ceiling (“up to”), not a guaranteed amount, and the only channel named is Session.
What UNM says and what remains unverified
The post in which BYOD claimed the attack on October 26 was far heavier than the apology. According to BleepingComputer, the group says it compromised 36,000 machines across campus and hospital, two Active Directory forests (the central directories that manage network users and permissions), two Oracle databases and the entire Microsoft Entra tenant. It also claims personal data on students and employees, including Social Security numbers, internal email, research data and patient lists from the Cerner electronic health record. The university has confirmed none of this and has not answered requests for comment on the data theft.
On October 28, HSC warned of possible scams by those responsible, including “false offers of payment or compensation,” and asked patients, students, employees and residents not to reply to anyone claiming credit for the incident, not to click links and not to share personal or financial data. Anyone contacted should keep the message and report it to the FBI’s Internet Crime Complaint Center. The $2,500 figure does not appear in the notice, but the wording describes exactly the kind of offer the group made.
The question of the free keys is also open. Gizmodo writes that it is unclear whether BYOD actually supplied decryption help that contributed to restoring the systems. The hospital was operational again in about a day, and the university points to work with outside partners.
- The 36,000 compromised devices come only from the group’s own post. How far the network was really breached therefore remains unknown, while the university speaks of some user devices and says the core systems stayed out of reach.
- The $2,500 promise comes from a criminal organization, and nobody has seen a payment. With the university warning about false compensation offers, anyone contacted may be dealing with an imitator of the group as well as the group itself.
- The apology does not cancel the threat to the data. BYOD says it is keeping it, so the risk of misuse or publication stays open for patients, students and employees until UNM clarifies what was copied.
- There is no confirmation that the free keys were delivered or that they shortened the recovery, which took about a day and which the university credits to its own technicians and outside partners.
Ransomware groups that apologize to hospitals
This is not the first time. In January 2023, LockBit, one of the busiest gangs in the sector, apologized for the attack on Toronto’s SickKids children’s hospital and released a free decryptor, blaming an affiliate that had broken the group’s rules, as Tripwire reports. In 2021, Conti handed the key to Ireland’s health service, the HSE. The script never changes. The damage comes first, the gesture second, and the hospital says it never negotiated.
BYOD adds, frankly, two twists. It claims credit for a “pentester” ethos (a pentester tests other people’s security) while encrypting a trauma center, and it puts a price on patients’ distress without giving up their data. The Trump Mobile precedent already showed a group that makes public what it takes. When healthcare stops, the damage is concrete, as the Synnovis attack showed, with a patient dead and an alleged Qilin member extradited to Germany.
Hospitals are under fire worldwide. The week before UNM, University Hospitals in Cleveland worked a weekend without critical systems and in Italy Space Bears claimed the Alma Center medical center. Readers who want to follow Italian cases can use the RedACT dashboard of ransomware claims, and on the patient data front there is the Johns Hopkins case, where the information of 3,182 people ended up in an unapproved AI tool
The apology arrives after the fact, with the ambulances already diverted and the data still in the group’s hands. Until a patient collects a single dollar and UNM says what was copied, this remains a statement from a criminal gang. Read it with caution, and reply to no one.
Frequently asked questions (FAQ)
1. Can UNM patients really receive the $2,500?
Nobody has shown that the payment exists. The group asks for proof of harmversity urges people not to reply to anyone claiming the attack and warns about false compensation offers. After a contact like that, the real risk is handing personal or financial data to someone with no connection to the case
2. What should you do if a hacker contacts a patient or an employee?
Do not reply, and keep the message. HSC recommends not clicking links, not opening attachments, not downloading files and not providing personal or financial information, and reporting the contact to the FBI through the IC3 portal. Outside the US, the contact should go to the national cybercrime authority (for example Action Fraud in the United Kingdom), with the same principle of not dealing with the sender.
3. Does the BYOD name have anything to do with “bring your own device”?
No, as far as anyone knows. In business settings BYOD (Bring Your Own Device) means personal devices used at work, and UNM even has an internal page on that policy. The group only borrows the same acronym, and no should not confuse it with rules about employees’ phones
4. Can you go to the UNM hospital right now?
Yes, the facilities are operating. Since October 28, HSC says all UNM Health facilities are fully functional, with ambulances, clinics and scheduled procedures back to normal, and anyone whose appointment was canceled on Monday should be contacted to book a new date.
5. Why do hospitals so often end up in ransomware groups’ sights?
A stalled hospital cannot wait. Diverted ambulances and postponed procedures put pressure on whoever decides whether to negotiate, and medical records fetch a high price on the black market. In the same two weeks UNM, University Hospitals in Cleveland and, in Italy, the Alma Center medical center were all hit.
