The University of New Mexico Health System told patients on Monday, October 26, not to come to its main Albuquerque hospital and canceled appointments at more than 30 clinics while it worked on what it called a “cybersecurity issue.” Ambulances were diverted, leaving New Mexico without an emergency department able to treat the most serious injuries, according to Associated Press reporting.
The nature and extent of the incident have not been disclosed. No ransom demand has been reported and no group has been named.
Statewide Level 1 Trauma Capacity Goes Offline in Albuquerque
UNM Health System operates the state’s only Level 1 trauma center. By diverting ambulances, the system removed the sole facility in New Mexico able to handle the most critical injuries. Presbyterian Healthcare Services and Lovelace Health System coordinated with UNM and took additional patients.
The scale of the system magnifies the disruption. It handles about 900,000 outpatient visits and 100,000 emergency room visits a year, and the clinic cancellations applied across its network of more than 30 locations.
UNM Health Begins Phased Restoration Later on Monday
Operations began resuming in phases later on Monday afternoon. The UNM Health Sciences Center also canceled classes. The health system has not published a timeline for full restoration.
Messages on Employee Computers Claim Stolen Student, Employee and Patient Data
Employees told reporters that late on Monday morning, messages appeared on computers claiming that student and employee data and patient information had been stolen. These accounts come from staff and have not been confirmed by the health system, which describes the matter as an active law enforcement investigation and declined to comment. The claims about stolen data remain unverified.
The pattern is consistent with a suspected ransomware or extortion attack, but that characterization is unconfirmed, and UNM has not said what systems were affected or how the intruders gained access.
FBI Assists While UNM Health Withholds Details
The FBI said it is assisting. UNM Health System has not described the cause of the disruption beyond the phrase “cybersecurity issue,” and it has not said whether patient records were accessed.
Josephine Wolff of Tufts University told the AP that breaching a system in order to play a message on computers is “pretty unusual.” Wolff’s comment points to the on-screen notices as an uncommon feature of this incident, though the underlying method has not been identified.
What Remains Unknown About the UNM Incident
Several basic questions are open: which systems were disrupted, whether data was taken, who is responsible and whether any demand was made. The health system has not said whether its electronic health records remained accessible during the diversion.
Hospital cyberattacks that force ambulance diversion move the risk beyond data exposure to access to emergency care. In this case, the diversion moved patients to Presbyterian and Lovelace facilities and left the state without a Level 1 trauma option until operations began to resume.
Further updates are expected from UNM Health System and the FBI as the investigation proceeds. The institution has not indicated when it will give a fuller account of what happened.
Timeline of the Monday Disruption at UNM Health System
The disruption unfolded over a single day. Late on Monday morning, employees reported messages on their computers. The health system then told people not to come to its main hospital in Albuquerque, canceled clinic appointments and diverted ambulances while it investigated. In the afternoon, operations began resuming in phases.
The effect on emergency care was the most consequential result. With the state’s only Level 1 trauma center diverting ambulances, statewide trauma capacity was removed for hours, and the appointment cancellations applied across the network. Presbyterian Healthcare Services and Lovelace Health System coordinated the response by accepting additional patients.
The health system’s response so far consists of ambulance diversion to other hospitals, assistance from the FBI and phased restoration of services. It has described the situation as an active law enforcement investigation and has said little else in public.
