Patient care resumes after cyberattack disrupts New Mexico health system

What Happened

The University of New Mexico Health Sciences Center experienced a cybersecurity event on October 26 that quickly became an operational emergency. The organization said its security teams took immediate steps to contain the event and protect the network. State and federal law enforcement were notified, external partners were engaged, and leadership activated an Emergency Operations Center to coordinate guidance for employees, students and frontline healthcare providers.

The initial response affected both clinical care and academic activity. UNM Health temporarily limited new patient admissions, diverted ambulances to nearby hospitals and suspended outpatient surgeries, appointments and clinics. Classes across its health sciences schools were canceled, while nonessential employees were directed to remain home. The hospitals remained open, and patients with emergencies were told to call 911.

Those actions mattered because UNM Health is a major statewide provider of specialist care, recording more than 1 million patient visits annually. Its flagship hospital in Albuquerque contains New Mexico’s only Level I trauma center. Even a temporary reduction in admissions, ambulance traffic or scheduled care therefore had implications beyond a single building or department.

Recovery moved relatively quickly. UNM later said all critical electronic systems were back online, hospitals were fully open, ambulance traffic had returned to normal, and clinics had resumed scheduled appointments and procedures. Its assessment found that some end-user devices were affected but that the event did not penetrate core systems or servers.

A newly identified ransomware group claimed responsibility and alleged that it had compromised 36,000 systems, identity infrastructure, databases, email and personal information. Those assertions have not been confirmed by UNM. The group also said it would retain allegedly stolen data even while offering decryption keys for healthcare systems. The claims should be treated as unverified statements from a criminal actor, not established findings about the incident.

Why It Matters

The clearest verified impact was disruption to healthcare delivery and education. Ambulance diversions, limited admissions, suspended procedures and canceled classes demonstrate how a cyber incident can create immediate operational consequences before investigators determine the technical cause, persistence or data impact. The fact that core systems were later reported unaffected does not erase the pressure placed on patients, clinicians, students and administrators during containment.

For executives, the incident is a reminder that severity cannot be measured only by the number of encrypted servers or confirmed stolen records. A defensive shutdown can itself affect critical services. Organizations need to evaluate how quickly they can preserve safe operations while security teams isolate devices, restrict access and determine whether central systems remain trustworthy.

The difference between UNM’s assessment and the ransomware group’s expansive claims is also important. Criminal groups have a financial incentive to exaggerate access and consequences. At the same time, their claims can identify areas investigators may need to examine. Leaders should avoid repeating those claims as facts while ensuring that identity systems, databases, communications platforms and endpoints named by the attacker are properly assessed.

Patients, employees and students also remain relevant to the risk picture. UNM advised these groups to watch for unsolicited communications and phishing attempts. Public reporting about a disruptive incident can give opportunistic attackers a credible pretext for fake support messages, account warnings or data-related scams even when the original attacker’s data-theft claims are unproven.

What to Watch

The central unresolved questions are the nature of the initial intrusion, whether any information was accessed or removed, and whether the event has been fully contained. UNM had not publicly confirmed ransomware as the cause in the supplied reporting, so the criminal group’s attribution and technical claims remain open issues rather than verified conclusions.

Further updates may clarify whether the affected end-user devices contained sensitive information, whether identity or administrative systems were exposed, and whether notification to patients, employees or students is required. Any official finding about data access should carry more weight than statements posted by the alleged attacker.

Defenders should also watch for renewed service disruption, unusual account activity and phishing tied to the incident. If recovery continues without evidence of core-system access, that would support UNM’s initial assessment. If new indicators emerge, the organization may need to revisit the scope. Until that process is complete, communications should distinguish clearly between confirmed operational facts, investigative findings and external claims.

What Defenders Should Do

Continuity first: Confirm that clinical teams can maintain safe care when admissions, ambulance routing, appointments or electronic workflows are restricted. Downtime procedures should identify who can authorize operational changes, how frontline staff receive instructions and how services return in a controlled order.

Containment and evidence: Preserve relevant endpoint, identity and network evidence while validating restored systems. Rapid recovery should not prevent investigators from determining how affected devices were reached, what accounts were used and whether the activity extended beyond the initially identified endpoints.

Identity and endpoint review: Examine the end-user devices identified in the official assessment and review associated accounts for unusual access. Because the alleged attacker made broad claims about directory, cloud identity and database environments, those claims can be used as investigative leads, but they should not be accepted as proof.

Recovery validation: Check that critical systems are not simply available but are operating from a trusted state. Closely monitor the period after restoration for recurring access, unexpected remote-management activity or attempts to re-establish persistence.

Communications: Give patients, employees and students a clear way to verify legitimate messages. Explain that unsolicited support requests, password-reset prompts and data warnings may be fraudulent. Internal updates should state what is known, what remains under investigation and which attacker claims are unverified.

Leadership oversight: Track operational recovery and technical investigation as related but separate workstreams. A service can be restored before the incident’s full scope is known, so leaders should avoid treating restored availability as proof that every security question has been resolved.

The Larger Lesson

Critical-service incidents create two parallel realities. The organization must restore safe operations quickly, while investigators need time to establish what happened and which claims are credible. Those timelines rarely move at the same speed.

This case also shows why incident severity should include service continuity, not only technical compromise. Temporary ambulance diversions, suspended procedures and canceled classes are significant outcomes even if later analysis confirms that core servers remained protected.

Finally, criminal statements should be handled with discipline. Ignoring them entirely can leave useful investigative leads unexplored, but repeating them as established facts can mislead patients, staff and decision-makers. Effective incident leadership separates verified impact, internal findings and attacker allegations while keeping recovery, evidence preservation and public trust moving together.