.jpg?w=1024)
A cybersecurity incident forced ambulance diversions at New Mexico’s only Level I trauma center.
The University of New Mexico Health System limited new-patient acceptance and suspended outpatient surgeries and appointments on Oct. 26. By late that evening, officials said both hospitals were open and clinics would resume scheduled care Oct. 27, while security teams continued responding.
For healthcare security leaders, the disruption highlights how quickly network containment can become a patient-care decision.
What UNM has confirmed
In its official update, UNM said it limited acceptance of new patients from 12:30 to 2:30 p.m. Monday, then began restoring operations and systems in phases. Other health systems in Albuquerque and Santa Fe helped accommodate patients.
UNM notified state and federal law enforcement, engaged external partners, and activated an Emergency Operations Center. Health Sciences classes remained canceled Tuesday, and nonessential employees were asked to stay home.
The update did not identify an attacker or confirm ransomware or patient-data theft.
Resuming care does not establish full recovery
Steven Swift, managing director of Suzu Labs, said the two-hour restriction on accepting new patients could reflect a precaution during containment. UNM has not confirmed that explanation.
“Often, especially early on when the blast radius of an incident is unclear, more systems than are strictly necessary may be put under containment,” Swift said in supplied comments.
Containment can involve disconnecting systems to prevent further unauthorized access. As this incident response guide explains, containment and recovery are separate steps. Restoring a service does not establish that the underlying threat has been removed.
In hospitals, those decisions require clinical input because isolating systems may also interrupt information and workflows needed for care.
Test the impact before an incident
Seemant Sehgal, founder and CEO of BreachLock, said proactive testing should help hospitals understand which systems could fail together and how those failures would affect care and diversion decisions.
“Having that information upfront is what lets a hospital protect its systems and its patients at the same time, rather than making both tradeoffs under live attack conditions,” he said.
Carefully scoped penetration testing can examine attack paths. Clinical downtime exercises can then test how staff work when systems become unavailable. The public evidence does not establish whether UNM lacked either form of preparation.
Make patient care part of the response plan
Healthcare security teams should map critical services to the systems they depend on, document safe fallback procedures, and establish who can limit admissions or request ambulance diversion. Exercises should include clinical leaders, emergency medical services, and neighboring hospitals so alternative capacity is considered before a crisis.
Recovery needs equally clear criteria. Teams should validate access, data integrity, and clinical workflows before declaring a service ready. These steps build on the healthcare cybersecurity lessons from earlier disruptions: plan for failure and connect security decisions to operational needs.
Further disclosures may clarify UNM’s affected systems and any data exposure. Other hospitals can act now by rehearsing how containment changes care delivery—and establishing the authority and evidence needed to make those decisions safely.