What happened
On October 26, 2026, UNM Health said all ambulance traffic was being diverted and all clinic appointments for that day were cancelled. UNM Health said the cybersecurity threat affected the entire University of New Mexico Health Sciences Center. UNM Health directed emergencies to 911 and asked patients to delay non-emergency care until further notice. The Associated Press reported that appointments were cancelled across more than 30 clinics.
On October 26, 2026, UNM Health told non-essential personnel and students across four Health Sciences schools to leave campus for the remainder of Monday. Clinical and essential employees were excluded from that instruction. The cited sources did not publish a restoration time, affected-system list, data-access finding or technical cause. Attribution posture: UNM Health has not identified an actor, confirmed ransomware or established responsibility in the cited disclosure.
Why this matters now
The verified impact crosses the threshold from an IT incident to a patient-care continuity event. Ambulance diversion and cancellation of all clinic appointments require coordinated decisions by clinical operations, emergency management, executive leadership and security. Healthcare organisations should compare their own escalation thresholds against this case rather than assuming that keeping an emergency department nominally open is sufficient evidence of safe continuity.
The absence of a published cause or data finding is decision-relevant. Restoration pressure must not erase forensic evidence or allow patient-safety recovery to be misrepresented as incident closure. Clinical operations can resume before the organisation knows whether protected information was accessed, persistence remains or credentials require containment; those workstreams need separate owners and closure criteria.
The decision for security leaders
Place clinical operations and patient safety in the incident command structure with authority equal to technical recovery. Each restored service should have a clinical validation owner, a documented fallback and a clear threshold for renewed diversion or cancellation.
Maintain two closure tracks: operational recovery and security investigation. A service may be usable while data-access, credential and persistence questions remain unresolved. Executive reporting should show both states rather than collapsing them into a single recovery percentage.
Require regional dependency mapping. Ambulance diversion transfers operational load to other providers, so continuity evidence must include receiving capacity and communications, not only the status of UNM systems.
Evidence of closure
- Clinical leadership signs off ambulance intake restoration.
- Clinic scheduling validation confirms normal appointment operations.
- Forensic reporting records the final data-access determination.
- Downtime records reconcile into restored clinical systems.
The Security.io assessment
The operational impact is confirmed and material; the attack mechanism is not. Security.io therefore treats this as a high-consequence resilience event with unresolved cyber scope, not as confirmed ransomware or a confirmed data breach.
The most important evidence over the next operating period is not a generic statement that systems are returning. It is proof that clinical workflows, scheduling, communications, medication processes and emergency intake function safely under expected load, accompanied by preserved forensic evidence.
Escalation should remain active until UNM distinguishes containment from restoration and publishes enough scope for patients, partners and regulators to understand whether confidentiality or notification decisions remain open.
Questions for the morning meeting
- Which clinical services immediately lose safe operating capacity when core digital systems become unavailable?
- Can regional partners absorb ambulance diversions without creating a secondary patient-safety risk?
- What evidence separates clinical restoration from the unresolved data-impact investigation?