A cyberattack on the University of New Mexico Health System forced ambulance diversions, canceled appointments and suspended outpatient surgeries on October 26, according to an official statement published on UNM Health’s website.
The disruption affected New Mexico’s only Level I trauma center and the broader UNM Health Sciences Center.
Officials activated an Emergency Operations Center, and UNM temporarily limited new patient admissions from 12:30 to 2:30 p.m. while IT security teams worked to contain the incident.
UNM began restoring systems Monday afternoon, with clinics scheduled to resume appointments and procedures October 27. Health Sciences Center classes remain canceled Tuesday as the investigation continues.
Seemant Sehgal, Founder & CEO, BreachLock:
“Diverting ambulances from the only Level I trauma center in the state is a serious consequence of cyber incident response being built around data breach scenarios rather than patient care disruption. The attack moved from a technical disruption to a patient care decision in the span of a shift, and the decision to continue admitting trauma cases while systems were still being contained had to be made with incomplete information while the attack was still active.
“With how quickly attackers move today, proactive pentesting is critical for healthcare systems. It tells clinical and IT teams which systems go down together, what the patient care impact looks like for each failure, and which diversion decisions need to be made at which thresholds. Having that information upfront is what lets a hospital protect its systems and its patients at the same time, rather than making both tradeoffs under live attack conditions.”
ㅤ
Steven Swift, Managing Director, Suzu Labs:
“The response to the breach appears to have been quickly contained and responded to, despite what appears to have been a major impact. They were prevented from admitting new patients for 2 hours. This is an oddly short time for such a critical service to be limited. Typically, if systems were adversely impacted to the extent that critical services were unavailable, it would take longer than 2 hours to restore functionality. Due to the short nature of this window, it appears likely that this service was taken down as a precaution.
“Its best practice in major security breach events to perform what’s called containment, which is the process of cutting off access to networks or systems. This is done to ensure that attackers are no longer able to access systems, and to allow recovery teams a window to perform emergency recovery services, without being actively interfered with by those same attackers.
“Often, especially early on when the blast radius of an incident is unclear, more systems than are strictly necessary may be put under containment. This is a practical trade off. The impact of containing some extra systems is relatively minor, compared to the harm that can be done if those systems remain unprotected and are further impacted by ongoing hostile activity.
“Major breach events for large organizations often take days to weeks to recover from. The timeline we’re being provided for this incident appears to be on the days rather than weeks timescale, suggesting that impact from the attackers was less than it could have been. Although full details haven’t been provided, and we’re left to read between the lines.
“HIPAA requires breach notifications to be published should the breach meet its requirements. This gives a 60 day deadline, if the response team determines that this incident falls within scope. We’ll know more if and when a formal breach notice is filed, or if the deadline passes and we don’t see one.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“A hospital cybersecurity incident puts two clocks in motion. The security team is working to contain the threat while clinicians are trying to deliver care. Unfortunately, those clocks don’t stop for each other.
“What concerns me most about incidents like this is that the consequences extend well beyond compromised computers or potentially exposed records. The real damage isn’t always the data leaving the network. Sometimes, it’s the patient who can’t get through the door. When a cybersecurity incident forces ambulance diversions and interrupts medical procedures, we’re no longer talking about an isolated IT problem. We’re talking about the availability of critical healthcare services.
“Healthcare organizations operate within a complex architecture of interconnected clinical systems, identities, networks, and third-party services. An attacker doesn’t necessarily have to compromise a medical device to disrupt patient care. Interrupting the systems that clinicians depend on may be enough.
“We need to move beyond periodic security assessments and validate how these environments withstand realistic attacks. That means testing potential attack paths, limiting the ability of an intrusion to spread, and rehearsing how essential medical services continue when technology becomes unavailable.
“Restoring systems is an important milestone, but it doesn’t necessarily establish that the underlying threat has been eliminated. We must find the exposure, fix the weakness, and independently verify the result.
“Ultimately, the measure of cybersecurity resilience in healthcare isn’t just how quickly systems come back online. It’s whether patients can continue receiving safe care while those systems are unavailable.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“Anytime I read stories like this, I try to think back to the early days of computer security, when it felt like there was at least some level of honor among thieves. Attackers wouldn’t necessarily go after critical infrastructure, hospitals, and healthcare organizations at the rate we’re seeing today.
“Of course, I also know that’s probably a pipe dream. It’s looking at the past through rose-colored glasses. But I genuinely don’t think we saw attacks against these organizations at the rate we’re seeing them now.
“A lot of financially motivated attackers have figured out that healthcare organizations are incredibly attractive targets because the pressure to restore operations can be enormous. We can have philosophical conversations all day long about whether organizations should negotiate with ransomware groups, whether they should pay, and whether paying simply encourages the entire ransomware ecosystem. But that conversation changes dramatically when lives are potentially on the line. Unfortunately, attackers understand that.
“The other side of this is that medical institutions are dealing with the same problems every other organization is dealing with. They have budget constraints. They have legacy software. They have operational requirements that make taking systems offline incredibly difficult. They have old infrastructure that can’t simply be replaced overnight. At the same time, they’re expected to keep everything patched, secure, operational, and up to date.
“Attackers understand both sides of that equation. They know these organizations are difficult to secure, and they know the consequences of downtime can be severe. That combination makes healthcare an incredibly attractive target for financially motivated attackers.”
ㅤ
Damon Small, Board of Directors, Xcape:
“The cyberattack on the University of New Mexico Health Sciences Center on October 26 disrupted ambulance services, canceled clinical appointments, and suspended outpatient surgeries. The incident affected New Mexico’s only Level I trauma center, raising serious concerns about the impact of cyberattacks on critical healthcare services.
“The ransomware group BYOD has claimed responsibility and alleges that it accessed employee and patient data for extortion purposes. These claims have not been independently verified, but they raise additional concerns about the confidentiality of sensitive healthcare information.
“The disruption to emergency services and delays in surgical care are particularly alarming. When a hospital cannot reliably accept patients or deliver time-sensitive treatment because of a cybersecurity incident, the consequences extend far beyond lost productivity or financial damage. Lives may be at stake.
“As we have written before, electronic health records (EHRs) and the supporting business systems required to maintain hospital operations are no longer ancillary IT assets. They are essential components of clinical infrastructure and should be protected with the same rigor applied to biomedical devices and other life-critical systems.
“Healthcare cybersecurity must be evaluated in terms of patient safety, not simply data protection or system availability. When an emergency department must divert patients because its systems cannot be trusted or safely operated, cybersecurity has become a direct clinical risk.
“The UNM incident is another reminder that protecting healthcare IT is fundamental to protecting patients. Healthcare organizations must treat cybersecurity as an integral part of patient safety and operational resilience—not merely an IT responsibility.”
Healthcare is easy for threat actors. That needs to change or else you will get situations like this. Because it’s all too easy for threat actors right now.
Related
This entry was posted on October 27, 2026 at 3:39 pm and is filed under Commentary with tags USA. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Cyberattack disrupts New Mexico’s only Level 1 trauma center and results in ambulance diversions
A cyberattack on the University of New Mexico Health System forced ambulance diversions, canceled appointments and suspended outpatient surgeries on October 26, according to an official statement published on UNM Health’s website.
The disruption affected New Mexico’s only Level I trauma center and the broader UNM Health Sciences Center.
Officials activated an Emergency Operations Center, and UNM temporarily limited new patient admissions from 12:30 to 2:30 p.m. while IT security teams worked to contain the incident.
UNM began restoring systems Monday afternoon, with clinics scheduled to resume appointments and procedures October 27. Health Sciences Center classes remain canceled Tuesday as the investigation continues.
Seemant Sehgal, Founder & CEO, BreachLock:
“Diverting ambulances from the only Level I trauma center in the state is a serious consequence of cyber incident response being built around data breach scenarios rather than patient care disruption. The attack moved from a technical disruption to a patient care decision in the span of a shift, and the decision to continue admitting trauma cases while systems were still being contained had to be made with incomplete information while the attack was still active.
“With how quickly attackers move today, proactive pentesting is critical for healthcare systems. It tells clinical and IT teams which systems go down together, what the patient care impact looks like for each failure, and which diversion decisions need to be made at which thresholds. Having that information upfront is what lets a hospital protect its systems and its patients at the same time, rather than making both tradeoffs under live attack conditions.”
ㅤ
Steven Swift, Managing Director, Suzu Labs:
“The response to the breach appears to have been quickly contained and responded to, despite what appears to have been a major impact. They were prevented from admitting new patients for 2 hours. This is an oddly short time for such a critical service to be limited. Typically, if systems were adversely impacted to the extent that critical services were unavailable, it would take longer than 2 hours to restore functionality. Due to the short nature of this window, it appears likely that this service was taken down as a precaution.
“Its best practice in major security breach events to perform what’s called containment, which is the process of cutting off access to networks or systems. This is done to ensure that attackers are no longer able to access systems, and to allow recovery teams a window to perform emergency recovery services, without being actively interfered with by those same attackers.
“Often, especially early on when the blast radius of an incident is unclear, more systems than are strictly necessary may be put under containment. This is a practical trade off. The impact of containing some extra systems is relatively minor, compared to the harm that can be done if those systems remain unprotected and are further impacted by ongoing hostile activity.
“Major breach events for large organizations often take days to weeks to recover from. The timeline we’re being provided for this incident appears to be on the days rather than weeks timescale, suggesting that impact from the attackers was less than it could have been. Although full details haven’t been provided, and we’re left to read between the lines.
“HIPAA requires breach notifications to be published should the breach meet its requirements. This gives a 60 day deadline, if the response team determines that this incident falls within scope. We’ll know more if and when a formal breach notice is filed, or if the deadline passes and we don’t see one.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“A hospital cybersecurity incident puts two clocks in motion. The security team is working to contain the threat while clinicians are trying to deliver care. Unfortunately, those clocks don’t stop for each other.
“What concerns me most about incidents like this is that the consequences extend well beyond compromised computers or potentially exposed records. The real damage isn’t always the data leaving the network. Sometimes, it’s the patient who can’t get through the door. When a cybersecurity incident forces ambulance diversions and interrupts medical procedures, we’re no longer talking about an isolated IT problem. We’re talking about the availability of critical healthcare services.
“Healthcare organizations operate within a complex architecture of interconnected clinical systems, identities, networks, and third-party services. An attacker doesn’t necessarily have to compromise a medical device to disrupt patient care. Interrupting the systems that clinicians depend on may be enough.
“We need to move beyond periodic security assessments and validate how these environments withstand realistic attacks. That means testing potential attack paths, limiting the ability of an intrusion to spread, and rehearsing how essential medical services continue when technology becomes unavailable.
“Restoring systems is an important milestone, but it doesn’t necessarily establish that the underlying threat has been eliminated. We must find the exposure, fix the weakness, and independently verify the result.
“Ultimately, the measure of cybersecurity resilience in healthcare isn’t just how quickly systems come back online. It’s whether patients can continue receiving safe care while those systems are unavailable.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“Anytime I read stories like this, I try to think back to the early days of computer security, when it felt like there was at least some level of honor among thieves. Attackers wouldn’t necessarily go after critical infrastructure, hospitals, and healthcare organizations at the rate we’re seeing today.
“Of course, I also know that’s probably a pipe dream. It’s looking at the past through rose-colored glasses. But I genuinely don’t think we saw attacks against these organizations at the rate we’re seeing them now.
“A lot of financially motivated attackers have figured out that healthcare organizations are incredibly attractive targets because the pressure to restore operations can be enormous. We can have philosophical conversations all day long about whether organizations should negotiate with ransomware groups, whether they should pay, and whether paying simply encourages the entire ransomware ecosystem. But that conversation changes dramatically when lives are potentially on the line. Unfortunately, attackers understand that.
“The other side of this is that medical institutions are dealing with the same problems every other organization is dealing with. They have budget constraints. They have legacy software. They have operational requirements that make taking systems offline incredibly difficult. They have old infrastructure that can’t simply be replaced overnight. At the same time, they’re expected to keep everything patched, secure, operational, and up to date.
“Attackers understand both sides of that equation. They know these organizations are difficult to secure, and they know the consequences of downtime can be severe. That combination makes healthcare an incredibly attractive target for financially motivated attackers.”
ㅤ
Damon Small, Board of Directors, Xcape:
“The cyberattack on the University of New Mexico Health Sciences Center on October 26 disrupted ambulance services, canceled clinical appointments, and suspended outpatient surgeries. The incident affected New Mexico’s only Level I trauma center, raising serious concerns about the impact of cyberattacks on critical healthcare services.
“The ransomware group BYOD has claimed responsibility and alleges that it accessed employee and patient data for extortion purposes. These claims have not been independently verified, but they raise additional concerns about the confidentiality of sensitive healthcare information.
“The disruption to emergency services and delays in surgical care are particularly alarming. When a hospital cannot reliably accept patients or deliver time-sensitive treatment because of a cybersecurity incident, the consequences extend far beyond lost productivity or financial damage. Lives may be at stake.
“As we have written before, electronic health records (EHRs) and the supporting business systems required to maintain hospital operations are no longer ancillary IT assets. They are essential components of clinical infrastructure and should be protected with the same rigor applied to biomedical devices and other life-critical systems.
“Healthcare cybersecurity must be evaluated in terms of patient safety, not simply data protection or system availability. When an emergency department must divert patients because its systems cannot be trusted or safely operated, cybersecurity has become a direct clinical risk.
“The UNM incident is another reminder that protecting healthcare IT is fundamental to protecting patients. Healthcare organizations must treat cybersecurity as an integral part of patient safety and operational resilience—not merely an IT responsibility.”
Healthcare is easy for threat actors. That needs to change or else you will get situations like this. Because it’s all too easy for threat actors right now.
Share this:
Like this:
Related
This entry was posted on October 27, 2026 at 3:39 pm and is filed under Commentary with tags USA. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.