A cyberattack diverted New Mexico’s only trauma center. Test your plan

A cyber incident at UNM Health on Monday diverted ambulances from New Mexico’s only Level 1 trauma center and closed more than 30 clinics, a reminder that downtime planning is a regional obligation, not just an IT one.

What happened in Albuquerque

On Monday, October 26, the University of New Mexico Health System detected a cybersecurity threat and moved quickly to contain it. The system diverted all ambulance traffic to other hospitals, told patients not to come to its main Albuquerque campus, and canceled appointments and outpatient surgeries at more than 30 clinics statewide. Health Sciences classes and research were suspended, and nonessential staff were sent home.

Technicians rebooted the network in the early afternoon, and the system began restoring operations in phases around 2:30 p.m. By late Monday evening, UNM Hospital and Sandoval Regional Medical Center were open again, with clinics set to resume scheduled care on Tuesday. Security teams were still working the incident, and UNM has cited an active law enforcement investigation, with the FBI assisting.

The scale matters. UNM Health handles roughly 900,000 outpatient visits and 100,000 emergency visits a year. During the diversion, New Mexico had no emergency department able to treat the most serious trauma. Presbyterian Healthcare Services and Lovelace Health System took additional patients. Employees also reported on-screen messages claiming that patient, student and employee data had been stolen; that claim has not been confirmed.

A fast recovery is not the usual outcome

UNM appears to have restored core services within about a day. That is far better than the norm. In February, a ransomware attack at the University of Mississippi Medical Center closed clinics statewide and took nine days to resolve, and industry tallies put average healthcare downtime after an attack well beyond two weeks. Leaders should not assume their own recovery would look like Albuquerque’s.

Questions for your next board or executive meeting

• Diversion and surge: If your largest regional neighbor went dark at 9 a.m., how many of its ED and trauma patients could you absorb, and who would make that call?
• Downtime operations: When did clinical teams last run a full shift on paper orders, manual medication administration and offline patient lists?
• Containment authority: Is it clear who can order a network shutdown, and how fast that decision reaches the command center?
• Data extortion: Do you have counsel, forensics and patient-notification plans ready if attackers claim data theft before you can confirm it?
• Academic exposure: For systems tied to a university, are clinical and academic networks segmented so that one compromise does not close both?

Sources

• A cybersecurity issue forces a major New Mexico hospital to divert patients and close clinics (Associated Press via KPRC, Oct 26, 2026)
• UNM Health cyberattack cancels appointments, diverts ambulances (Albuquerque Journal, Oct 26, 2026)
• UNM Health restores systems, reopens clinics after cyber incident (Becker’s Hospital Review, Oct 27, 2026)