UNM Health cybersecurity event diverts ambulances and restricts intake

A cybersecurity event at UNM Health on October 26 forced the system to divert ambulances and restrict new patient intake for two hours, disrupting care across New Mexico’s only Level 1 trauma center. While the hospitals reopened by Monday night, the incident triggered a wave of clinic cancellations and left questions lingering about the security of patient and employee data, Medical Daily reported.

This wasn’t just a glitch in one building. The disruption hit UNM Hospital, Sandoval Regional Medical Center, and more than 30 clinics. For a window between 12:30 p.m. and 2:30 p.m. on Monday, the system simply couldn’t take in new patients. In a region where the UNM system manages roughly 100,000 emergency room visits and 900,000 outpatient visits annually, a two-hour freeze creates a ripple effect across the healthcare grid.

The danger of a single point of failure

When a hospital goes on diversion, paramedics route patients to other facilities. In a metro area with several hospitals, that usually just means a slightly longer ride. But for the most critically injured patients in New Mexico, the stakes are higher. UNM Hospital operates the only Level 1 trauma center within about 400 miles.

Amenaza de ciberseguridad en UNM Health: ambulancias desviadas, clínicas cerradas y estudiantes e…

If you are in the middle of a catastrophic accident, every minute spent in transit is a minute of lost intervention. While Presbyterian Healthcare Services and Lovelace Health System stepped in to take additional patients, the sheer scale of the UNM system means any pause in service is a risk. UNM has not yet disclosed how many ambulances were diverted or if any specific patient care was delayed during the outage.

The timeline of the collapse was rapid. The breach was detected around 11:30 a.m. Monday. Within 40 minutes, staff received internal messages ordering them to shut down computers, unplug hardware, and kill the Wi-Fi on all mobile devices. By the afternoon, the health system issued a blunt warning: non-emergencies should be delayed, and emergencies must go through 911.

Unconfirmed claims of a massive data heist

While the systems came back online in phases starting at 2:30 p.m., a secondary battle began over what—if anything—was stolen. A recorded message played on staff computers claimed that attackers had seized personal data from students and employees, including Social Security numbers.

Ataque de ciberseguridad en UNMH provoca el desvío de ambulancias a otros hospitales

The situation escalated when an extortion group known as BYOD claimed on its leak site to have compromised 36,000 machines across the hospital and main campus environments. The group further alleged they had obtained rosters from the Cerner electronic health record system.

UNM has not confirmed these claims. Steve Carr, a spokesperson for the main campus, stated that the threat is not university-wide. Because of an active law enforcement investigation involving the FBI, the institution has remained tight-lipped about whether ransomware was used or if patient records were actually accessed.

“Emergencies should be handled by 911, and non-emergencies should be delayed until further notice.”

The friction between transparency and investigation

There is a natural tension here. UNM is working with state and federal law enforcement to contain the event, and the FBI is assisting.

If the BYOD group actually holds 36,000 machine compromises, the “containment” is merely the first step in a recovery process.

For now, the practical reality is a matter of vigilance. Patients whose appointments were canceled should verify any rescheduling calls by dialing the clinic’s official published number. This is a necessary precaution because breach news often triggers a second wave of attacks: phishing scams where criminals pose as hospital administrators to steal insurance details or Social Security numbers.

Those concerned about their data can place a free credit freeze with the three major credit bureaus or monitor insurance statements for services they never received. These are standard safety measures, not confirmation that a specific individual was targeted.

The hospitals are open. The clinics are running.

Keep reading