Health · Cybersecurity · New Mexico
UNM Health Reopens Hospitals and Clinics After Cybersecurity Disruption
New Mexico’s largest academic health system says its hospitals are open and clinics have resumed scheduled care after a cyber event briefly diverted ambulances and canceled appointments. The cause, actor and any exposure of personal information remain under investigation.
By Health Politics Daily News Desk · October 27, 2026 at 2:03 p.m. ET
Watch in this article
Pumpjack operating at the Kern River Oil Field
A short CC0 field video provides visual context for reporting on oil production and fuel supply.
Thomas Farley / Wikimedia Commons · CC0 1.0 · License and source
Verified baseline
The University of New Mexico Health Sciences Center said it experienced a cybersecurity event Monday, October 26. UNM Health temporarily limited acceptance of new patients from 12:30 to 2:30 p.m., diverted ambulance traffic, suspended outpatient surgeries and canceled clinic appointments while security teams contained the event.
UNM began restoring operations in phases at 2:30 p.m. Its latest public update says UNM Hospital and Sandoval Regional Medical Center are open and clinics resumed regularly scheduled appointments and procedures Tuesday. Academic and research classes remained canceled Tuesday, and nonessential Health Sciences Center employees were told to stay home.
Why the disruption mattered
UNM Hospital operates New Mexico’s only Level I trauma center. The health network handles about 900,000 outpatient visits and 100,000 emergency visits a year, according to the Associated Press. Presbyterian Healthcare Services and Lovelace Health System accepted additional patients during the disruption.
A cyber incident can affect care even before investigators determine whether information was stolen. Registration, imaging, medication records, scheduling, communications and ambulance coordination can depend on connected systems. Hospitals may take systems offline as a containment measure, which can be disruptive but does not by itself prove that an attacker controlled every affected service.
What patients should know
Patients with scheduled UNM appointments should use official UNM Health channels to confirm timing, particularly if Monday care was canceled. UNM says it will work with patients to reschedule missed appointments and procedures. For a medical emergency, call 911; do not delay urgent care while trying to determine which facility is accepting patients.
People should be cautious about unexpected calls, texts or emails claiming to offer compensation, account recovery or breach monitoring. UNM has not announced a confirmed data breach or an official notification program. Verify any message through contact information independently obtained from the health system’s official website.
What is not confirmed
Employees told AP that messages displayed on workplace computers claimed student, employee and patient information had been stolen. UNM has not verified that claim publicly, identified an attacker or described the incident as ransomware. The FBI confirmed to AP that it was assisting, but provided no attribution or technical details.
A hostile message is evidence of a disruption, not proof that every claimed file was obtained. Determining exposure normally requires forensic review of affected systems, logs and data flows. Any legally required notices would follow the applicable investigation and notification process.
Fact, analysis, forecast and opinion
Verified fact: the event disrupted patient intake, ambulance routing, appointments and classes before phased restoration began. Analysis: the incident shows how a technology failure at one regional hub can shift demand across an entire emergency-care network. Forecast: investigators may later clarify the cause and any data exposure, but no reliable timetable is public. Opinion: Health Politics Daily supports prompt, specific operational updates and transparent breach notification once facts are established.
Bias Lens: operational disruption or unverified breach?
Verified baseline: UNM confirmed a cyber event and temporary care disruption; it has not confirmed data theft, ransomware or attribution.
Official source: UNM Health Sciences Center emphasizes containment, phased restoration and current operations. Center coverage: the Associated Press foregrounds the temporary loss of the state’s highest-level trauma intake and carefully labels employee-reported theft claims as unconfirmed.
We did not force a left-versus-right comparison because no sufficiently detailed, original ideological coverage of this operational incident was available at review time. The meaningful framing difference is between the provider’s restoration-focused update and independent reporting on patient-care consequences and unverified claims.
What remains uncertain
UNM has not disclosed the entry point, affected systems, duration of unauthorized access, whether protected health information was accessed or when the investigation will conclude. Resumed clinical operations also do not necessarily mean every internal system has returned to normal.
Principal sources
- UNM Health Sciences Center — operational updates
- Associated Press — care disruption, regional response and FBI confirmation
- UNM Health — emergency and trauma services
No suitable official or publisher-authorized video with clear downstream embedding permission was available, so no video was embedded.