Patient care was disrupted when a cyberattack knocked critical electronic systems offline across UNM Health on October 26. Ambulances were diverted for two hours, appointments and outpatient surgeries were canceled, and new patients were temporarily limited. Hospitals stayed open, and critical systems and normal ambulance traffic were restored by early October 27. Containment limited the confirmed impact to some end-user devices and kept the intruder from core systems and servers.
What Happened
UNM Health detected a cyberattack on October 26 that prevented access to critical electronic systems across the University of New Mexico Health Sciences Center. The operational response was immediate because the outage affected a healthcare environment that includes UNM Hospital, New Mexico’s only level 1 trauma center. All ambulance traffic was temporarily diverted to alternative hospitals, appointments were canceled, new-patient acceptance was limited, and outpatient surgeries were called off while teams worked to protect the network. The ambulance divert lasted from 12:30 to 2:30 p.m. Other health systems in Albuquerque and Santa Fe helped ensure that patients could continue receiving care. The wider disruption also reached the university’s health education programs. Students at the schools and colleges of medicine, pharmacy, nursing, and population health were asked to leave campus, and classes were canceled. UNM Health said containment began at around 11 a.m. and was largely successful. Some end-user devices were affected, but the organization said the threat actor was prevented from reaching core systems and servers. Hospitals remained open throughout the incident. By 10:27 p.m. on October 26, UNM Health said clinics would resume regularly scheduled appointments the following day. Critical systems were back online and ambulance traffic had returned to normal by the early hours of October 27. External cybersecurity partners assisted with remediation, law enforcement was notified, and the incident is under criminal investigation. The organization had not determined whether patient data was involved. A ransomware group claimed responsibility and made broad assertions about compromised systems and stolen data, but those claims were not independently verified in the supplied reporting. The confirmed story is therefore one of serious but relatively short-lived operational disruption, rapid containment, and an investigation whose full scope remains unresolved.
Why It Matters
This incident demonstrates how quickly a cyberattack can become a patient-safety and regional-capacity problem. The most visible consequences were not limited to unavailable computers. Ambulances had to be redirected, scheduled care was canceled, new-patient acceptance was restricted, and neighboring providers had to absorb demand. Those decisions carry clinical, operational, financial, and reputational consequences even when an organization prevents an attacker from reaching its core servers. The setting raises the stakes further. Disruption at the state’s only level 1 trauma center can affect emergency-care planning beyond the compromised organization itself. The event also shows why recovery metrics must include care delivery. Restoring a server is not the same as safely resuming appointments, ambulance intake, surgery, education, and communication across a large health system. The reported containment outcome is important: affected end-user devices did not automatically lead to confirmed compromise of core systems and servers. Segmentation, quick isolation, prepared decision-making, and access to external support can determine whether an incident remains constrained or develops into a prolonged regional emergency. The unknown data impact also matters. Operational recovery can move faster than a forensic investigation, leaving privacy, notification, and longer-term security decisions open after clinical services resume.
What to Watch
The next material development will be the investigation’s determination of how the attacker entered, which devices and accounts were accessed, and whether any patient, student, employee, payroll, email, or clinical information was taken. Claims posted by the ransomware group should remain unverified unless UNM Health or investigators confirm them. If unauthorized data access is established, notification and protection obligations may follow, but the supplied evidence does not yet establish that outcome. It will also be important to watch whether the restoration remains stable and whether additional systems require remediation after deeper forensic review. Because the case is under criminal investigation, public details may remain limited while evidence is preserved and the scope is assessed.
What Defenders Should Do
Immediate continuity action: healthcare leaders should validate who has authority to divert ambulances, limit admissions, cancel outpatient services, and coordinate with neighboring providers when critical systems become unavailable. Those decisions should have clear triggers, contact paths, and backup communications that can function without the affected network. Containment action: security teams should be able to isolate impacted end-user devices quickly while protecting core clinical and infrastructure systems. The reported response shows the value of beginning containment early and bringing external cybersecurity partners into the incident when internal capacity is under pressure. Recovery action: restore services in a patient-safety order rather than treating every unavailable system as equally urgent. Teams should verify that recovered systems are trustworthy before reconnecting them and should coordinate technical restoration with clinical owners who can confirm that care workflows are safe to resume. Investigation action: preserve evidence, review identity and endpoint activity, determine whether the attacker reached sensitive repositories, and separate confirmed findings from claims made by the alleged attacker. Leadership action: include clinical operations, communications, legal, privacy, law enforcement liaison, education leadership, and regional-care partners in the incident structure. A health system’s response cannot sit solely with its technology team when ambulances, appointments, surgery, students, and public confidence are affected. Exercise action: rehearse a scenario in which hospitals stay open but selected digital systems are unavailable. The exercise should test patient diversion, appointment communication, support from nearby providers, staged restoration, and the transition from emergency operations back to normal service.
The Larger Lesson
Cyber resilience in healthcare is ultimately a continuity-of-care discipline. Data protection remains essential, but the first executive question during an outage is whether patients can still receive safe and timely treatment. UNM Health’s experience also illustrates the value of limiting blast radius. An attacker affected end-user devices and caused real disruption, yet the organization reported that core systems and servers were protected and normal ambulance operations returned within hours. That does not settle the forensic or privacy questions, but it changes the operational outcome. Strong preparation connects technical containment with clinical authority, regional coordination, and disciplined recovery. The durable measure of success is not whether an organization avoids every incident. It is whether the organization can contain the event, protect essential systems, make safe service decisions, and restore operations without allowing unverified attacker claims to control the response.