UNM Hospitals Hit With Synthetic Voice Extortion

A cyberattack disrupted University of New Mexico Health hospitals, forcing ambulance diversions and canceled clinical appointments. During the incident, attackers reportedly played a synthetic voice message on hospital workers’ computers claiming they had stolen sensitive data and directing administrators to contact them through encrypted messaging.

Key findings

• UNM Health diverted ambulance traffic and canceled clinic appointments after detecting a cybersecurity incident.
• Attackers reportedly played a synthetic voice message on hospital workers’ computers during the attack.
• The message claimed theft of student and employee data, including personally identifiable information and Social Security numbers, and directed administrators to encrypted messaging.
• The BYOD extortion group claimed responsibility and alleged compromise of 36,000 machines, though those claims remain unconfirmed.
• Healthcare staff were reportedly instructed to shut down and unplug computers and disable Wi-Fi on mobile devices after the breach was detected.

Who’s being targeted

• Commonly targeted roles: Hospital administrators, Healthcare workers, Clinical operations staff, IT and security teams, University employees, Incident response leaders.
• Affected industries: Healthcare, Hospitals, Higher Education, Medical Research.

Awareness takeaways

• Treat unexpected audio or onscreen messages demanding contact through private or encrypted channels as a possible extortion attempt. Report them immediately through the organization’s established incident-reporting process rather than replying or negotiating.
• During a suspected active cyber incident, follow IT’s containment instructions promptly, including disconnecting affected devices when directed.
• Hospital leaders should maintain tested continuity procedures for patient care, including diversion and communications plans, because cyber incidents can disrupt clinical operations quickly.