In an unusual development in the world of cybercrime, a hacker group that claimed responsibility for a cyberattack on a major hospital in the United States has publicly apologised to patients and offered financial compensation of up to $2,500 per affected individual. The incident involved the University of New Mexico (UNM) Health Sciences Center, where a cybersecurity attack disrupted hospital operations, forced ambulances to be diverted and led to the cancellation of medical appointments.
The group, identified as BYOD, claimed that it had not realised some of the compromised computer systems were being used to support patients receiving medical treatment in real time. Following the incident, the hackers offered free decryption keys for affected hospital devices and promised payments to patients who could provide evidence of harm.
However, the apology has raised serious questions about the growing threat of cybercrime against healthcare institutions, the safety of sensitive medical information and whether cybercriminals can be trusted to honour such promises.
What Happened at the University of New Mexico Hospital?
The cybersecurity incident occurred on October 26, 2026, at the University of New Mexico Health Sciences Center in Albuquerque, New Mexico, United States.
The hospital’s security team detected suspicious activity at approximately 11 a.m. local time and immediately began taking measures to contain the threat.
The incident quickly affected healthcare operations. Ambulances were temporarily redirected to other hospitals in Albuquerque and Santa Fe, while outpatient procedures and medical appointments were suspended.
More than 30 clinics were affected by the disruption. The situation was particularly concerning because UNM Hospital operates New Mexico’s only Level I trauma centre, which provides the highest level of emergency and surgical care for patients suffering from critical injuries.
The disruption temporarily left the state without its primary facility for treating the most severe trauma cases.
Other healthcare providers, including Presbyterian Healthcare Services and Lovelace Health System, coordinated with UNM to accommodate additional patients.
The incident also affected the university’s academic operations. Classes at several health sciences colleges, including medicine, nursing, pharmacy and public health, were cancelled temporarily.
Who Are the Hackers Behind the Attack?
The group claiming responsibility for the incident is known as BYOD, a relatively new cybercriminal group associated with ransomware and data breaches.
Following the attack, BYOD reportedly claimed that it had compromised approximately 36,000 devices across the university’s main campus and hospital network.
The group also alleged that it had accessed sensitive databases containing student records, employee information, internal communications and patient-related information.
It further claimed to possess personal information, including Social Security numbers belonging to students and employees.
However, these claims have not been independently verified, and the University of New Mexico has not confirmed the full extent of the alleged data theft.
The university’s initial assessment indicated that some end-user devices had been affected, while its core systems and servers were not impacted.
The group reportedly used its data-leak website to publish information about the attack and communicate its demands and subsequent apology.
Hackers Apologise and Offer Patients $2,500 Each
The most surprising development came after the hackers published an apology on October 27.
BYOD claimed that it had not understood that some of the compromised hospital machines were being used to assist patients in real time.
The group subsequently offered to provide free decryption keys for the remaining locked devices belonging to the hospital sector.
It also announced financial compensation of up to $2,500 for each patient who could demonstrate that they had been affected by the incident.
In its statement, the group said:
“To any patient that was affected, please provide us proof, and we will pay you up to $2,500 each for the inconvenience.”
The hackers also attempted to defend their actions by claiming that they had a moral position despite their involvement in cyberattacks.
They stated that they had a heart and were not villains, while arguing that their activities were intended to hold organisations accountable for poor cybersecurity practices.
However, the apology came with a significant condition: BYOD stated that it would continue retaining the data it claimed to have stolen.
This means that even though the group offered decryption assistance and financial compensation, it did not promise to delete or return the allegedly compromised information.
It is also important to understand that the $2,500 offer has not been independently verified. There is currently no confirmed evidence that patients have received payments.
How Did the Hospital Respond?
The University of New Mexico responded by prioritising the restoration of its healthcare services and securing affected systems.
By Tuesday afternoon, October 27, the university announced that critical electronic systems had been restored, hospital facilities were fully open and ambulance services had returned to normal operations.
Medical appointments and procedures also gradually resumed.
The university notified law enforcement authorities about the incident, and the investigation became a criminal matter. The FBI confirmed that it was assisting its partners.
Importantly, UNM did not officially classify the incident as a ransomware attack, despite the hackers’ claims and their offer of decryption keys.
The university also made it clear that it had not negotiated with or made concessions to the group behind the threat.
It issued a warning to patients, employees and students not to communicate with anyone claiming responsibility for the incident.
Officials specifically cautioned people against clicking suspicious links, downloading attachments or sharing personal and financial information with individuals promising compensation.
The warning is particularly important because cybercriminals sometimes use the confusion following a data breach to launch additional scams.
Why Are Hospital Cyberattacks So Dangerous?
Cyberattacks against hospitals are particularly concerning because they can directly affect people’s lives.
Unlike attacks targeting ordinary businesses, healthcare institutions depend on digital infrastructure to manage patient records, medical appointments, diagnostic information, laboratory systems and hospital administration.
When these systems become unavailable, doctors and nurses may face difficulties accessing important patient information.
In emergency situations, even relatively short disruptions can create serious operational challenges.
Hospitals also store highly sensitive information, including medical histories, contact details, identification documents, insurance information and financial records.
If such information is stolen, it can potentially be misused for identity theft, financial fraud, blackmail or other criminal activities.
The UNM incident demonstrates how a cybersecurity problem can extend beyond computers and networks to disrupt essential public services.
BYOD’s Previous Cybersecurity Attacks
The hospital incident is not the first time the BYOD group has attracted attention.
The group has also claimed responsibility for other cyber incidents, including a breach involving Trump Mobile customer information.
In that incident, the group reportedly claimed access to records belonging to more than 3,600 customers.
Its activities have raised concerns about the increasing number of cybercriminal groups targeting organisations and exploiting weaknesses in their digital infrastructure.
Although some groups attempt to justify their activities as efforts to expose poor security practices, unauthorised access to computer systems and the theft of personal information remain serious criminal matters.
An apology does not remove the potential consequences for organisations and individuals affected by such attacks.
Will Patients Actually Receive the $2,500 Compensation?
Despite the unusual offer, there are several reasons why patients should remain cautious.
First, the payment promise has come directly from the group claiming responsibility for the attack, rather than from the hospital or an official compensation programme.
Second, the university has specifically warned people against engaging with individuals offering payments in connection with the incident.
Third, BYOD has stated that it intends to retain the data it claims to have stolen, creating additional concerns about patient privacy and future misuse.
As of October 31, 2026, there has been no verified confirmation that the hackers have paid any affected patients or that the hospital has approved the compensation arrangement.
Patients who believe they may have been affected should rely on official University of New Mexico communications rather than contacting the hackers directly.
A Warning for Healthcare Institutions Worldwide
The University of New Mexico incident highlights an important lesson for healthcare organisations worldwide: cybersecurity is no longer simply an IT responsibility; it is an essential part of patient safety.
Hospitals must continuously strengthen their digital infrastructure through regular security audits, encrypted backups, network monitoring, access controls and employee cybersecurity training.
They must also maintain emergency procedures that allow essential medical services to continue even when computer systems become unavailable.
The hackers’ unusual apology and $2,500 compensation offer have attracted international attention, but the bigger issue remains unresolved: the security of sensitive patient information.
The incident is a reminder that cyberattacks can have consequences far beyond financial losses. When healthcare infrastructure is targeted, patients, doctors and entire communities can be affected.
Whether BYOD eventually honours its compensation promise remains uncertain. For now, the investigation continues, and the university’s priority remains protecting its systems, patients and sensitive information.
