Article
What happened in Albuquerque
On Oct. 26, the University of New Mexico Health Sciences Center detected a cybersecurity incident affecting its clinical IT systems. UNM Health diverted ambulances, limited new admissions, and canceled appointments and outpatient surgeries while its teams contained the threat. Students and nonessential staff were sent home, and health sciences classes were canceled for a second day.
Recovery was relatively fast. Critical systems were restored early on Oct. 27, ambulance traffic returned to normal, and clinics resumed scheduled care. Neighboring health systems in Albuquerque and Santa Fe absorbed patients during the disruption. A ransomware group has claimed it stole employee, student and patient data. UNM has not confirmed those claims, and the investigation, which involves law enforcement, is ongoing.
Why it matters beyond New Mexico
UNM Hospital is a 618-bed academic center that handles roughly 80,000 emergency visits a year. When a hub like that goes on diversion, even for hours, the load lands on nearby EDs that may already be full. With flu admissions running high this fall, a similar event in another market could stress an entire region.
The episode also shows how fast an IT problem becomes a clinical, academic and reputational one. Data-theft claims can surface within hours, often before the hospital knows the scope, and attackers increasingly push messages straight to staff to raise pressure.
Questions for the executive team and board
- Diversion decisions: Who decides to divert, on what criteria, and how quickly do EMS and neighboring hospitals hear about it?
- Mutual aid: Do you have written agreements with regional partners to take patients during a cyber outage, and have you exercised them together?
- Downtime readiness: Can each unit run on paper for 72 hours, including medication administration, lab results and imaging orders?
- Communications: Are holding statements ready for patients, staff, students and media that are accurate without confirming unverified claims?
- Segmentation: If end-user devices are compromised, are the EHR and core clinical servers isolated enough to keep running?
Sources
- University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack (HIPAA Journal, Oct 28, 2026)
- Cyberattack Disrupts New Mexico’s Only Trauma Center (BankInfoSecurity, Oct 27, 2026)
- Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack (The Register, Oct 27, 2026)