UNM Health Cybersecurity Incident Diverted Every Ambulance

In the UNM Health cybersecurity incident on October 26, 2026, the health system diverted every ambulance away from its main Albuquerque hospital, home to New Mexico's only Level 1 trauma center, and cancelled appointments at more than 30 clinics. UNM later said only some end-user devices were affected, which is exactly why hospital security teams should pay attention.

What did UNM Health confirm on October 26?

UNM Health confirmed a cybersecurity incident on Monday, October 26, 2026, but has said almost nothing about its cause. Its IT security teams identified the threat around 11 a.m. and began containment. The first public update was blunt: “The University of New Mexico Health System is experiencing a cybersecurity issue at this time.”

Leadership activated an Emergency Operations Center, brought in outside support and notified unnamed state and federal law enforcement agencies. Pierluigi Paganini of Security Affairs called that the right sequence: isolate first, investigate second, communicate continuously. As of his November 5, 2026 report, the incident remained under criminal investigation.

Why did New Mexico lose its only Level 1 trauma center?

UNM Health runs the state’s only Level 1 trauma center, built for the most serious and complex injuries, and it diverted all ambulance traffic away from its main Albuquerque hospital. According to the report, New Mexico briefly had no emergency department able to treat the most severe injuries.

• Patients were told not to come to any UNM Health facility. Emergencies went to 911; non-emergencies were delayed until further notice.
• Appointments at all clinics were cancelled for the day.
• From 12:30 p.m. to 2:30 p.m., UNM stopped accepting new patients.
• Outpatient surgeries and appointments were suspended for the rest of the day.

UNM said “system outages also required the suspension” of outpatient care, so the pause was not purely precautionary.

Did the UNM Health cybersecurity incident stay on end-user devices?

UNM says it did, and nobody outside the organization can verify that yet. UNM later stated that some end-user devices were affected and core systems and servers were not. Its day-one update said the threat was “affecting the entire University of New Mexico Health Sciences Center.” Classes were cancelled and nonessential employees went home.

Clinical work runs on endpoints: registration desks, nurse stations, imaging viewers. Pull those off the network and the EHR servers can be untouched while the trauma bay still cannot operate safely.

No threat actor, malware family, CVE, initial-access vector or IOC has been published. Nothing in the public record says this was ransomware, and we will not guess.

Practitioner’s note: treat a first-day “endpoints only” statement as provisional until EDR data from every host and the identity logs have been reviewed. Before declaring containment, check domain controllers, backup servers and hypervisors for mass password resets, GPO changes and backup deletion.

Were patient, student or staff records stolen?

Nobody knows yet. Employees reported messages claiming that patient, student and staff data had been stolen. UNM has not confirmed exfiltration or who sent them. Fast recovery settles nothing: next-day restoration fits a contained event or a clean restore, and neither tells you whether data left the network.

UNM also warned of phishing and fraud exploiting the incident. Expect lures in the victim’s branding: fake billing notices, rescheduling links, credit-monitoring offers. Staff who have practiced in a phishing simulation are harder to catch while the real incident unfolds.

How did the region absorb the diversion?

Presbyterian Healthcare Services and Lovelace Health System coordinated with UNM and took additional patients. Restoration began Monday afternoon, and by Tuesday, October 27, hospitals, ambulance services and clinics were back to normal, according to UNM. That outcome depended on two competitors having spare capacity, so regional mutual aid is part of your recovery plan whether you have written it down or not.

What should a security lead pressure-test after a diversion-level outage?

Test the path from a compromised workstation to a diversion decision, not just the path to domain admin.

• Divert trigger. Agree with clinical leadership in advance on which technical states force diversion.
• Endpoint blast radius. Count the clinical workstations that share credentials, management tooling or network segments with office laptops. An assumed breach assessment that starts from one nurse-station login answers this quickly.
• Downtime operations. Drill registration, orders and scheduling on paper for 24 hours.
• Communications. Pre-write patient notices and publish one official channel, so fraudsters cannot fill the silence.

Score the result in clinical terms: hours without ambulance acceptance, clinics cancelled, surgeries lost. A ransomware readiness assessment should report on those numbers, not a malware name.

FAQ

What happened at UNM Health on October 26, 2026?

UNM Health detected a cybersecurity threat around 11 a.m., diverted ambulances from its main Albuquerque hospital and cancelled clinic appointments and outpatient surgeries for the day.

Did UNM Health confirm a ransomware attack?

No. UNM has named no threat actor, malware family, vulnerability or entry point, and describes only an incident affecting some end-user devices.

Was patient data stolen in the UNM Health incident?

Unconfirmed: employees received messages claiming data theft, but UNM has not confirmed exfiltration or who sent them.

Which hospitals took patients while UNM was diverting?

Presbyterian Healthcare Services and Lovelace Health System, and UNM said its operations were back to normal on October 27.

agent::offense tests hospital networks from a single compromised endpoint all the way to clinical impact, so you know your diversion trigger before an attacker finds it. See our HIPAA penetration testing.