UNM Health Shuts Clinics and Diverts Patients During Security Incident
A major cybersecurity threat forced New Mexico's only Level 1 trauma center to suspend operations.
1Emergency Operations Disrupted
On October 26, 2026, the University of New Mexico Health System faced a severe cybersecurity incident. The organization was forced to divert all incoming ambulance traffic to other regional providers and cancel appointments across more than 30 clinics. This disruption impacted the state's only Level 1 trauma center, complicating emergency care access.
2Immediate Containment Measures
IT security teams identified the threat at approximately 11 a.m. and initiated containment protocols. Leadership activated an Emergency Operations Center and engaged external support while notifying state and federal law enforcement agencies. The system temporarily stopped accepting new patients between 12:30 p.m. and 2:30 p.m. to protect the integrity of the network.
3Scope of System Impact
The security event affected various end-user devices throughout the University of New Mexico Health Sciences Center. While core systems and servers remained protected, the outage necessitated the suspension of outpatient surgeries and clinical appointments. Additionally, the institution canceled classes for medical, nursing, and pharmacy students to prioritize the ongoing network security efforts.
4Regional Healthcare Coordination
To manage the sudden influx of patients, UNM Health coordinated with Presbyterian Healthcare Services and Lovelace Health System. These providers absorbed the diverted ambulance traffic and patient volume, demonstrating regional resilience during the crisis. By Monday afternoon, the hospital began restoring systems, and operations returned to normal status by the following day.
5Data Security Concerns
While UNM Health has not confirmed any data exfiltration, employees reported receiving messages claiming that patient, student, and staff information had been stolen. The institution issued warnings to the public regarding potential phishing and fraud attempts. Attackers often exploit such incidents to deceive individuals through social engineering tactics and malicious communication.
6Criminal Investigation Status
The cybersecurity incident remains under active criminal investigation by law enforcement authorities. Officials are working to determine the origin and nature of the threat that targeted the health system. The focus remains on identifying the perpetrators while ensuring that all digital infrastructure remains secure against any further unauthorized access or malicious activity.
7Operational Resilience Lessons
The incident highlights the critical vulnerability of healthcare networks to cyber threats. By isolating affected devices and suspending non-essential services, UNM Health followed a standard protocol of containment before investigation. This event underscores the necessity for hospitals to maintain robust emergency response plans that account for both physical and digital infrastructure failures.
8Future Security Outlook
Healthcare institutions must remain vigilant against evolving cyber threats that target sensitive medical data. The rapid restoration of services at UNM Health demonstrates the effectiveness of coordinated regional responses. Moving forward, the focus will likely shift toward strengthening endpoint security and enhancing communication strategies to protect patients from secondary fraud attempts.