Cybersecurity event Monday, October 26, 2026; classes canceled for a second day on October 27, 2026
UNM Health Diverted Ambulances and Closed More Than 30 Clinics After a Cybersecurity Event
The University of New Mexico Health Sciences Center, which includes the UNM Health clinical delivery system and the state's only Level 1 trauma center, experienced a cybersecurity event on Monday, October 26 that forced it to divert ambulances, cancel appointments at more than 30 clinics, and send nonessential staff and students home. In its statement Monday evening, the university said its security teams took immediate steps to contain the event, notified state and federal law enforcement, engaged external partners, and activated an Emergency Operations Center; it announced the event at 14:30 local time, and hospitals and clinics began resuming operations in phases later the same day. The Associated Press reported that the system handles about 900,000 outpatient visits and 100,000 emergency room visits a year, that Presbyterian Healthcare Services and Lovelace Health System took additional patients, and that an FBI spokesperson in Albuquerque said the agency was assisting. UNM has not described the nature of the attack. The Register notes that a newly assembled group calling itself BYOD claimed responsibility on Monday afternoon and claimed to have compromised 36,000 machines and taken student, employee, and patient data, and cautions that a group's claim does not prove it was responsible or that a ransomware payload was deployed; employees told the AP they heard messages on their computers claiming data had been stolen. Classes in medicine, nursing, and pharmacy were canceled for a second day on Tuesday while hospital appointments and clinics returned to normal, with recovery continuing in phases.
Executives
For several hours, one incident removed the only Level 1 trauma center in a state from ambulance service. That is the planning case for every hospital system: downtime procedures, mutual aid agreements with neighboring systems, and a communications sequence that works when staff are being told to unplug their computers. UNM had peer systems able to take patients the same day; verify yours does too, in writing, before you need it.
CIO / CISO
Hold two facts apart in your own reporting, because UNM is holding them apart in its statements: the operational impact is confirmed, and the attacker's claims about 36,000 machines and stolen patient data are not. Under HIPAA, the breach determination turns on what your investigation finds about protected health information, not on what a leak site asserts, so preserve evidence now and let the forensic record, not the claim, drive notification decisions.
Engineers
The containment pattern UNM described, disconnecting endpoints and mobile devices from the network on instruction, works only if staff hear it and trust it. Test how an unplug instruction reaches clinical areas when email and chat may be part of the incident, and confirm your downtime workstations and paper workflows cover registration, orders, and medication records for at least a full clinic day.
Everyone (non-IT)
If you were a UNM patient this week, follow the university's official notices about rescheduled appointments, and be skeptical of emails or calls claiming to be about your stolen records until UNM itself confirms what, if anything, was taken. Attackers use real incidents as cover for phishing within days.