A cyberattack on New Mexico's largest academic health system diverted ambulances from the state's only Level I trauma center this week, while a newly disclosed Cisco firewall zero-day and a confirmed breach of 2.5 million Sony ISP customer records rounded out a day in which edge devices and service providers again bore the brunt of the damage.
Case file: UNM Health ransomware attack
- Who: University of New Mexico Health Sciences Center (UNM Health), including UNM Hospital in Albuquerque and Sandoval Regional Medical Center.
- What: A cyberattack detected on Monday, October 26, 2026, that disrupted patient care, forced ambulance diversions, and cancelled clinics and classes.
- Scale: A new ransomware group calling itself Byod claims it compromised 36,000 systems and stole patient, student, and employee data. UNM Health has not confirmed those claims and says its assessment found affected end-user devices but no penetration of core systems or servers.
- Status: Critical electronic systems were restored by Tuesday afternoon, October 27; hospitals are fully open and ambulance traffic is normal. The data-theft claims remain unverified and under criminal investigation.
Incident timeline
| Date | Development |
|---|---|
| October 19, 2026 | Sony Network Communications' So-net member database is breached; the intrusion is detected four days later. |
| October 26, 2026 | UNM Health security teams identify a threat at around 11 a.m.; the health system diverts ambulances, cancels clinic appointments, and suspends outpatient surgeries. |
| October 27, 2026 | UNM Health cancels health-sciences classes and restores critical electronic systems by Tuesday afternoon; Byod claims responsibility on its leak site. |
| October 28, 2026 | Cisco publishes its advisory for actively exploited ASA/FTD zero-day CVE-2026-76418; Sony Network Communications confirms 2,585,481 customer records exposed; U.S. law enforcement seizes the Virtualine bulletproof-hosting domain. |
| October 29, 2026 | CISA's deadline for federal agencies to remediate the exploited PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) arrives; UNM Health denies paying a ransom. |
UNM Health: ambulances diverted, surgeries halted, claims unverified
UNM Health is the clinical arm of the University of New Mexico Health Sciences Center and runs New Mexico's only academic medical center. Its flagship, UNM Hospital in Albuquerque, houses the state's only Level I trauma center, treating roughly 7,000 critically ill or injured patients a year, with the nearest alternative more than 400 miles away. That geography is why a two-hour ambulance diversion on Monday afternoon mattered far beyond the campus: patients across a vast rural catchment had to be routed elsewhere while clinics cancelled appointments and outpatient surgeries were suspended.
The university's first public notice, at 2:30 p.m. on Monday, warned patients not to visit its facilities that day and urged anyone facing a medical emergency to call 911. By Tuesday, critical electronic systems were back online, hospitals were fully open, and clinics were resuming scheduled care.
Investigation notes: UNM Health
What is confirmed: a cyberattack disrupted operations on October 26, ambulances were diverted, and systems were restored by October 27. What is claimed but not verified: Byod, a group listing only a handful of victims on its leak site, says it compromised 36,000 systems across the main campus and hospital environments, including Active Directory forests, the entire Microsoft Entra tenant, and two Oracle databases, and accessed Social Security numbers, payroll records, research data, and patient information. UNM Health's own assessment points the other way — affected end-user devices, no penetration of core systems or servers — and the university has not confirmed any data theft. The group also reportedly said it would take down its leak-site post after UNM Health initiated communication, and offered free decryption keys for affected healthcare facilities. Treat the 36,000-system figure as an attacker's claim, not a finding, until forensic work confirms it. Patients should reschedule missed care, ignore unexpected requests for personal information, and watch for an official breach notice.
Cisco patches an actively exploited firewall zero-day
Cisco released security updates for CVE-2026-76418, a high-severity denial-of-service zero-day in Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. The flaw, scored CVSS 8.6, stems from logic errors when secondary authentication is configured on a tunnel group: an unauthenticated remote attacker can send a crafted request while connecting to the SSL remote-access VPN and force the device to reload unexpectedly. No successful VPN login is required, and Cisco's Product Security Incident Response Team became aware of active exploitation in October 2026.
Investigation notes: Cisco CVE-2026-76418
Exposure requires the webvpn keyword in the configuration, SSL VPN enabled on at least one interface, and a tunnel group with secondary authentication — not every ASA/FTD device qualifies, so inventory by configuration, not just software version. Cisco has published no indicators of compromise and has not identified the attackers or targeted organizations, and the impact confirmed so far is denial of service, not remote code execution or data theft. Admins who cannot patch immediately can mitigate by disabling secondary authentication on the DefaultWEBVPNGroup or affected user-configured tunnel groups, at the cost of weakening VPN login. Watch for unexpected reloads and crash files on VPN gateways.
Sony ISP subsidiary confirms breach of 2.5 million customer records
Sony Network Communications, the Sony Group subsidiary that operates as an internet service provider in Japan, confirmed that an unauthorized party accessed its So-net member database, exposing 2,585,481 current and former customer records. The breach occurred on October 19 and was detected four days later, when the company shut down the compromised servers and blocked external communication. Exposed data includes full names, phone numbers, email addresses, user IDs, dates of birth, and gender; the company also said 54,401 email addresses and account passwords were exposed and advised users to change their passwords.
Investigation notes: Sony Network Communications
The four-day detection gap and the inclusion of passwords alongside identity data make this a credential-stuffing risk for affected customers well beyond the ISP itself: any reused password should be treated as compromised. Sony has not named an attacker or an intrusion vector, and no ransomware claim has been attached to the incident in reporting so far. The scale — 2.5 million records — makes this the largest confirmed breach count in today's brief, even though the operational drama sat with UNM Health.
ENGIE discloses a partner-tool breach affecting French customers
French energy giant ENGIE confirmed that attackers stole customer data after breaching a marketing platform used by business partners for customer prospecting and energy-offer sales. ENGIE says its internal IT systems were not compromised and no banking data was affected; the incident is limited to customers in France, and the company has individually notified those affected and alerted the relevant authorities. Notification letters list names, mailing addresses, email addresses, phone numbers, customer IDs, contract numbers, and energy supply identifiers (delivery points for electricity, metering points for gas).
Investigation notes: ENGIE
The pattern is familiar and worth naming: the breached system was a partner-facing sales tool, not ENGIE's core infrastructure, yet it held enough identity and contract data to power convincing impersonation and phishing. ENGIE has not disclosed how many customers were affected, when the intrusion began, or who the attacker was. Contact and contract data without banking details still enables supplier-impersonation fraud — customers should verify any energy-related message through ENGIE's own channels.
PHP2Shell deadline day, and the Virtualine takedown
Today is the deadline CISA set for federal civilian agencies to remediate the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, after adding them to the Known Exploited Vulnerabilities catalog on October 26. The unauthenticated remote-code-execution flaws affect all PHP installations serving web requests; fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Separately, U.S. law enforcement seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating phishing, spam, carding, ransomware, botnets, and infostealers; Dutch police said dozens of physical servers were seized in Limburg, hundreds of virtual servers were taken offline, and data from more than 3,000 customers was recovered for follow-up action.
Investigation notes: PHP2Shell and Virtualine
On PHP2Shell, note the correction history: Sophos walked back an initial report of successful exploitation, saying it reflected scanning and failed attempts, and Palo Alto Networks' Unit 42 retracted an earlier assessment tying the flaws to an attack on a European government agency. CISA's KEV listing stands, but the scale of successful exploitation remains unclear — patch on the KEV deadline, not on the hype. On Virtualine, a takedown of hosting infrastructure is a disruption to criminal operations, not an end to them; expect migration to replacement services and watch for follow-on enforcement from the recovered customer data.
Sources
- UNM Health ransomware attack diverts ambulances and halts surgeries — PCRisk
- New Cisco firewall zero-day exploited to crash SSL VPN devices — BleepingComputer
- Sony ISP subsidiary data breach exposes 2.5 million customer records — BleepingComputer
- Energy giant ENGIE discloses data breach affecting customers — BleepingComputer
- Critical vulnerabilities in PHP require immediate patching — CISA
- Japan's GMO Internet urges customers to shut down PCs after hackers threaten ransomware attack — Cybersecurity News
