A cybersecurity incident at the University of New Mexico Health Sciences Center disrupted patient care on Monday 26 October, forcing the health system to divert ambulances to other hospitals and cancel appointments across its clinics. The system told people not to attend its main hospital in Albuquerque and cancelled appointments at more than 30 clinics while its teams worked to contain the incident and protect the network. The disruption mattered well beyond one hospital: UNM Hospital in Albuquerque is New Mexico's only Level I trauma centre, so diverting its emergency department left the state temporarily without a unit equipped for the most serious injuries.

How services recovered

Hospitals remained open during the incident, and access began returning in phases later on 26 October. Ambulance traffic ran from about 12:30 p.m. to 2:30 p.m. that day, according to the health system's updates, and critical systems were reported back online in the early hours of 27 October, with clinics resuming scheduled appointments. The university said it had notified state and federal law enforcement, activated an emergency operations centre and brought in external partners to help investigate.

What remains unconfirmed

The university has described the event only as a cybersecurity incident and has not publicly confirmed the attack type, how intruders got in, or whether patient or staff data was exposed. A ransomware group calling itself BYOD has claimed responsibility, with reports citing its claim of compromising tens of thousands of systems and accessing personal, payroll, research and patient information. Those claims have not been independently verified and are not confirmed by the university. Readers should therefore treat the group's claims as claims, not as established facts about the scale of any data theft.

Sources: Associated Press, via EMS1 and The Register and HIPAA Journal.