A cybersecurity incident at the University of New Mexico Health System caused major patient-care disruptions on Monday, October 26, forcing ambulance diversions, appointment cancellations and temporary restrictions at the state’s only Level I trauma center.
UNM Health instructed patients not to arrive at its main Albuquerque hospital and canceled appointments across more than 30 clinics. Classes at the University of New Mexico Health Sciences Center were also canceled.
The incident clears a high threshold for cybersecurity significance because it affected emergency medical capacity, disrupted a large regional healthcare network and temporarily left New Mexico without an emergency department able to provide the state’s highest level of trauma care.
UNM Health said its hospitals and clinics began resuming operations in phases later Monday. No complete restoration timeline was announced.
OTHER HEALTH SYSTEMS ABSORBED DIVERTED PATIENTS
Presbyterian Healthcare Services and Lovelace Health System coordinated with UNM Health to receive additional patients during the disruption.
The diversion demonstrates how a cyber incident at one hospital can create immediate operational pressure across an entire region. UNM Health reports approximately 900,000 outpatient visits and 100,000 emergency-room visits annually, making it a central component of New Mexico’s healthcare infrastructure.
The outage therefore carried risks beyond delayed appointments. Emergency diversions can increase transport times, place additional demand on neighboring hospitals and reduce the region’s capacity to respond to major accidents or other mass-casualty events.
FBI ASSISTING WITH THE INVESTIGATION
The FBI confirmed that it was assisting its partners but did not disclose technical details about the incident.
UNM Health described the event as a cybersecurity issue and said it remained an active law-enforcement investigation. Officials had not publicly identified an initial access vector, threat actor or specific malware family as of Monday evening.
The available evidence does not yet justify describing the incident as ransomware. Although its operational effects resemble those seen in ransomware attacks against hospitals, UNM Health has not confirmed that systems were encrypted, that an extortion demand was received or that a ransom was requested.
EMPLOYEES REPORTED MESSAGES CLAIMING DATA THEFT
Multiple employees told the Associated Press that messages appeared across workplace computers claiming student, employee and patient information had been stolen.
Those reports are significant but remain allegations. UNM Health has not confirmed that an attacker exfiltrated data, and no verified number of affected people or exposed records has been released.
The distinction matters because an attacker-controlled message is not independent proof that data was taken. Such claims require validation through forensic evidence, including outbound network traffic, compromised account activity, cloud audit records and artifacts found on affected systems.
Patients and employees should nevertheless remain alert for phishing, fraudulent medical billing messages and attempts to obtain identity or insurance information. Any future disclosure confirming the theft of protected health information would represent a material expansion of the incident.