Incident Response
Cyberattack forces New Mexico hospital to divert patients and close clinics
A cyber incident at the University of New Mexico Health System led to diverted ambulances, cancelled appointments at over 30 clinics, and disruption to the state's only Level 1 trauma centre.
Ross Grant2 min read
The short version
A cyberattack hit the University of New Mexico Health System, causing its main hospital and over 30 clinics to cancel appointments and divert ambulances. Some staff saw messages saying data was stolen, but the hospital has not confirmed this. The FBI is helping investigate. Operations began to resume later the same day.
By the numbers
- 900,000outpatient visits per year at UNM Health SystemSecurityWeek
- 100,000emergency room visits per year at UNM Health SystemSecurityWeek
- 30+clinics affected by appointment cancellationsSecurityWeek
What happened?
A cyber incident disrupted the University of New Mexico Health System, forcing it to divert ambulances and cancel appointments at over 30 clinics. The hospital is the state's only Level 1 trauma centre. Employees reported messages claiming data theft, but the hospital has not confirmed what was taken. The FBI is assisting in the investigation.
Who is affected
The University of New Mexico Health System (UNM Health) was hit by a cybersecurity incident that disrupted operations at its main hospital in Albuquerque and more than 30 associated clinics. UNM Health runs the state’s only Level 1 trauma centre, which treats the most serious injuries. The disruption meant that ambulances had to be diverted to other hospitals, and patients arriving for appointments were told to reschedule. Classes at the Health Sciences Center, New Mexico’s largest academic medical centre, were also cancelled on the day of the incident. According to its website, the network handles about 900,000 outpatient visits and 100,000 emergency room visits each year.SecurityWeek (opens in a new tab)
What was taken
Several UNM Health employees reported seeing messages on their computers claiming that student, employee, and patient data had been stolen. However, the health system has not confirmed what, if any, data was actually taken. The hospital spokesperson declined to comment, citing an ongoing law enforcement investigation.
How the attack worked
The exact method used by the attackers has not been made public. What is unusual, according to Tufts University cybersecurity professor Josephine Wolff, is that the attackers managed to display messages across staff computers. This type of breach, where messages are broadcast to many endpoints, is not common in hospital cyber incidents. There is no confirmation yet of ransomware or a specific type of malware being involved.
The response
UNM Health told people not to come to its main hospital and cancelled appointments at its clinics while it worked to resolve the issue. Other major healthcare providers in New Mexico, including Presbyterian Healthcare Services and Lovelace Health System, coordinated to take extra patients. UNM Health began resuming operations in phases later the same day. The FBI confirmed it is assisting in the investigation but did not provide details. Local law enforcement agencies have also been contacted, but have not commented publicly.
What you should do
For healthcare organisations, this incident is a reminder to review incident response plans and ensure that backup systems and communication channels are robust. Staff should be trained to recognise unusual activity on their computers and know how to report it quickly. Patients affected by the disruption should watch for updates from the hospital and monitor their personal information for signs of misuse if data theft is confirmed.
Claimed vs confirmed
- Unconfirmed
Messages claimed student, employee, and patient data was stolen.
UNM Health employees reported seeing these messages, but the hospital has not confirmed any data theft.
Why it matters
This incident disrupted emergency care in an entire state, showing how a cyberattack can affect critical services like hospitals. It also highlights the risk to sensitive patient and staff data if attackers gain access to healthcare systems.
Key points
- UNM Health System diverted ambulances and cancelled appointments due to a cyber incident.
- Messages claimed data theft, but the hospital has not confirmed what was taken.
- The FBI is involved in the investigation.
- The attack disrupted the state's only Level 1 trauma centre.
- Other hospitals had to take extra patients during the disruption.
Sources
SecurityWeek
Reference
