Patient care was disrupted when a cyberattack hit the University of New Mexico Health Sciences Center. Ambulances were diverted, appointments across more than 30 clinics were canceled, and health sciences classes were called off. Hospitals later reopened, with systems and services returning in phases. An extortion group claimed extensive data theft, but those claims remain unconfirmed.
What Happened
A cyberattack at the University of New Mexico Health Sciences Center moved quickly from an information technology problem to a healthcare disruption. The center encompasses clinical care, research, education, the state’s largest teaching hospital, and New Mexico’s only Level 1 trauma center. After the issue was announced, ambulance traffic was diverted to other hospitals, people were told not to arrive at the main hospital, and appointments were canceled across more than 30 clinics. Health sciences classes were also canceled.
The breach was reportedly detected around 11:30 a.m. on Monday. About 40 minutes later, healthcare workers were instructed to shut down and unplug computer systems and turn off Wi-Fi on mobile devices. The organization said its security teams were containing the event, external partners were helping with the investigation, and state and federal law enforcement had been notified. Other major healthcare providers in Albuquerque and Santa Fe coordinated with UNM Health and accepted additional patients.
Operations began returning later that day. UNM Health said all hospitals were open and that clinics would resume appointments and procedures scheduled for Tuesday, October 27, 2026. Systems were being restored in phases rather than brought back simultaneously.
Employees also reported hearing a synthetic voice message on workplace computers. The message claimed that student, employee, patient, identity, email, and other data had been stolen. An extortion group called BYOD claimed responsibility and published additional allegations about compromised machines, databases, identity systems, payroll, student records, research information, email, and electronic health record rosters. Those claims remain unconfirmed, and it is unclear whether ransomware was used to encrypt systems.
Why It Matters
The immediate consequence was reduced access to care. Diverting ambulances from the state’s only Level 1 trauma center affected more than one organization. It required nearby health systems to absorb additional demand and gave patients fewer normal options for emergency treatment. Canceling clinic appointments also created a backlog that may need to be managed as systems and services return.
This incident illustrates why healthcare cybersecurity cannot be measured only by whether data was encrypted or stolen. Availability matters because clinical operations depend on connected systems, communications, scheduling, patient records, and other digital services. Even when hospitals remain physically open, uncertainty about the safety or availability of technology can force staff to change how patients are received and treated.
The shutdown instruction also shows the difficult tradeoff during containment. Disconnecting systems can help limit an intruder’s access, but it can remove tools that clinical and administrative teams normally use. Hospitals therefore need rehearsed alternatives that support care while security teams investigate.
The possible data exposure is a separate concern, but the available evidence does not confirm the extortion group’s claims. The operational disruption is confirmed and material on its own. Leaders should treat restoration, patient safety, evidence preservation, and breach assessment as related but distinct workstreams.
What to Watch
The investigation has not established the full nature or extent of the attack. It remains unclear how the attacker entered, which systems were accessed, whether data was removed, and whether ransomware or another destructive mechanism was deployed. Claims made by the extortion group should remain unverified until supported by the investigation.
The pace and stability of phased restoration will be important. Hospitals and clinics have resumed operations, but bringing systems online is not the same as completing recovery. Additional disruption could occur if dependencies are unavailable or systems need further containment.
Affected patients, employees, and students should watch for official findings about data exposure and any specific protective steps. The organization’s later disclosures may also clarify whether the reported messages on employee computers were part of the initial intrusion, an extortion tactic, or both.
What Defenders Should Do
Immediate response: maintain clear authority for clinical continuity, containment, investigation, and public communication. Preserve evidence from affected systems while keeping untrusted devices isolated. Coordinate ambulance diversion and patient transfers with nearby providers, and communicate service availability through channels that do not depend on the affected network.
Restoration: return systems in controlled phases based on clinical priority and verified trust. Confirm critical dependencies before reconnecting services. Monitor restored systems for signs of unauthorized activity, and keep manual alternatives available until operations are stable.
Investigation: establish which identities, endpoints, servers, databases, and cloud services were accessed. Test the attacker’s claims against system evidence rather than treating an extortion message as confirmation. If the investigation identifies exposed credentials or identity systems, revoke sessions and reset access based on the affected scope.
Preparedness: use the incident to validate downtime procedures for emergency care, clinics, scheduling, internal communications, and health sciences education. Ensure staff know how to receive instructions when email, Wi-Fi, or managed computers cannot be trusted. Include regional healthcare partners and law enforcement contacts in exercises because a major hospital disruption can shift demand across an entire area.
The Larger Lesson
Cyber resilience in healthcare is regional, not merely organizational. A disruption at a major hospital changes where ambulances travel, where patients seek treatment, and how neighboring providers allocate capacity. Technical containment decisions therefore have direct operational consequences.
The incident also demonstrates the value of phased recovery. Restoring everything quickly can create additional risk when the intrusion’s scope is uncertain. A controlled return allows teams to prioritize critical care, validate systems, and preserve investigative options.
Finally, an attacker’s public claims and the confirmed impact should be evaluated separately. The data allegations may prove serious, but they remain unconfirmed. The ambulance diversion, clinic closures, canceled classes, and need for regional coordination already show why healthcare security planning must focus on continuity and safety as well as confidentiality.