The finding
A cybersecurity event at the University of New Mexico Health Sciences Center forced a two-hour ambulance diversion, cancellation of outpatient surgeries and clinic appointments, and closure of health-sciences classes. UNM says the event affected some end-user devices but did not penetrate core systems or servers.
That distinction is the central finding. Healthcare continuity can fail before an electronic health record, database or central server is breached. If enough workstations, communications tools or connected workflows become unavailable or untrusted, clinicians may be unable to accept patients safely even while core platforms remain intact.
What happened, and when
UNM says information-security teams began containment around 11 a.m. on October 26 and activated an Emergency Operations Center. The health system brought in external partners and notified state and federal law enforcement. From about 12:30 p.m. to 2:30 p.m., ambulances were redirected to other hospitals. Outpatient procedures and appointments were suspended for the rest of the day.
Phased restoration began at about 2:30 p.m. By 2:02 p.m. on October 27, UNM reported that critical electronic systems were online, hospitals were fully open, ambulance traffic was normal and clinics had resumed scheduled care. Academic disruption lasted longer: health-sciences classes were canceled Tuesday, with programs expected to resume Wednesday.
AP reported that neighboring systems coordinated to absorb additional patients. That is an important part of the incident boundary: a hospital diversion transfers operational pressure rather than eliminating it.
Verified findings and allegations
The official account establishes endpoint effects, clinical disruption, phased restoration and an active criminal investigation. It does not establish the initial access method, the number or type of affected devices, whether ransomware was used, whether information was copied, or who was responsible.
BleepingComputer reported that a group calling itself Byod claimed to have compromised 36,000 systems and stolen data. Those are alleged attacker claims, not verified findings. UNM has not confirmed the group's account, and the reported scale does not sit comfortably with UNM's narrower statement that core systems and servers were not penetrated. Both claims should remain attributed until further evidence appears.
Lessons
Measure cyber impact by care pathways, not just by server availability. A useful continuity test follows a patient from ambulance dispatch or appointment arrival through identity checks, clinical documentation, orders, results, discharge and follow-up. If any indispensable step depends on unavailable endpoints, the pathway is not restored.
Device isolation also needs a clinical counterpart. Plans should define who authorizes diversion, how neighboring hospitals are warned, which outpatient work is paused, how canceled procedures are prioritized, and what evidence is required before each service returns.
Restore in verified stages. Bringing critical systems online is only one milestone; teams should validate representative end-to-end workflows before declaring a clinical capability recovered. Finally, keep criminal claims separate from the operational timeline. Unverified ransomware or theft allegations can change, while the documented consequences—diverted ambulances and canceled care—already justify the lesson.
What remains uncertain
UNM has not disclosed the initial access method, affected device classes, whether ransomware was used, whether data was copied, or how many patients and procedures were affected. The Byod group's claims about 36,000 systems and stolen data are unverified. The public record does not establish clinical-data integrity effects or patient-safety outcomes.
Sources & method
AI-assisted research and drafting, reviewed by the editor before publication. Reporting is attributed to the sources below; this is not an independent forensic investigation.
- Update on Cybersecurity Event at UNM Health Sciences Center · Original source · 2026-10-27
- A cybersecurity issue forces a major New Mexico hospital to divert patients and close clinics · Reporting · 2026-10-27
- UNM Health ransomware attack disrupts patient care, surgeries · Reporting · 2026-10-27