UNM Health Closes Clinics and Diverts Ambulances After Cybersecurity Incident Disrupts New Mexico’s Only Level‑1 Trauma Center
What Happened — On 26 October 2026 the University of New Mexico Health System (UNM Health) detected a cybersecurity incident affecting end‑user devices across its network. The threat was contained before reaching core servers, but the organization activated its Emergency Operations Center, halted outpatient surgeries, cancelled appointments at more than 30 clinics, and diverted all ambulance traffic away from its Albuquerque campus—the state’s sole Level 1 trauma center. The shutdown lasted several hours while internal IT staff and external responders worked to isolate the affected endpoints and restore services. State and federal law‑enforcement agencies were notified, and patients were instructed to seek emergency care elsewhere.
Why It Matters for Trust & Control Assurance — The event tests the effectiveness of an organization’s incident‑response and business‑continuity controls, a core control objective that underpins many frameworks (e.g., HIPAA, NIST CSF).
Who Is Affected — Healthcare providers, hospital networks, and any organization that delivers critical patient‑care services.
Recommended Actions
- Review and update your incident‑response playbook to ensure rapid isolation of compromised endpoints without impacting core clinical systems.
- Conduct tabletop exercises that simulate a service‑disruption scenario for critical care pathways.
- Verify that evidence of response actions (e.g., logs, containment timestamps) can be collected and presented for audit readiness.
Technical Notes
- Attack vector: unknown; the incident appeared to originate on end‑user workstations, not on privileged servers.
- No ransomware, data exfiltration, or confirmed malware signatures were reported.
- The organization’s IT team identified the issue at 11 a.m., began containment, and restored normal operations by the evening of 26 Oct 2026.
Source: Security Affairs