What happened
On October 26, 2026, containment began at about 11:00 a.m.; ambulances were diverted from 12:30 p.m. to 2:30 p.m., and phased restoration began at 2:30 p.m. UNM Health suspended outpatient surgeries and appointments for the rest of the day, activated its Emergency Operations Center, notified law enforcement and coordinated patient redirection with other health systems.
On October 28, 2026, UNM said classes and research had resumed, clinical operations were fully functional and it had made no concessions. UNM’s assessment said some end-user devices were affected but core systems and servers were not penetrated. On October 29, 2026, reporting said the FBI-led criminal investigation continued while the scope of any data theft remained unknown.
The cited sources did not establish an initial-access vector, confirmed data exfiltration, encryption, a ransom amount or a named actor. No IP addresses, domains, malware names, hashes or filenames were published in the cited official update. Attribution posture: UNM has not named an actor, and reporting says the ransomware-group claim is acknowledged but remains unverified while the FBI investigates. UNM warned patients, staff and students not to engage with groups offering payments or compensation. The cited source did not publish the specific operational detail described as Attack method and data impact.
Why this matters now
The operational sequence demonstrates the difference between rapid service restoration and complete security closure. UNM restored clinical operations quickly enough to limit ambulance diversion to two hours, but the public evidence does not establish the intrusion vector, whether data left the environment or whether every affected endpoint has been rebuilt or cleared.
Healthcare leaders should examine the continuity mechanisms that allowed hospitals to remain open while outpatient activity, ambulance acceptance and academic operations were disrupted. The relevant measure is not only time to restore technology; it is whether care could be redirected safely, whether clinical teams received reliable instructions and whether restoration decisions were based on patient-safety and security evidence.
The public warning about follow-on scams adds an identity and communications responsibility. Even without confirmed data theft, attackers or opportunists may contact patients, staff and students. Communications, fraud and incident teams need an agreed verification channel so recipients can distinguish legitimate recovery notices from malicious payment, compensation or credential requests.
The decision for security leaders
Separate restoration authority from incident-closure authority. Clinical leadership may restore a service when patient-safety and continuity criteria are met, while security and legal teams continue investigating compromise, data exposure and notification. Both decisions need distinct evidence and named approvers.
Require healthcare continuity plans to define how ambulance diversion, appointment suspension, manual workflows and academic closures are initiated and reversed. The plan should identify capacity dependencies with neighbouring providers and preserve decision records for later clinical, regulatory and security review.
Do not amplify the ransomware claim as attribution. Maintain an extortion decision process and preserve communications, but base public and board reporting on UNM’s confirmed operational facts until forensic or law-enforcement evidence establishes the attacker, method or data impact.
Evidence of closure
- Clinical service validation confirms safe operation after restoration.
- Endpoint records prove affected devices were rebuilt or forensically cleared.
- A forensic report supports the core-system non-penetration conclusion.
- An approved assessment determines whether protected data left the environment.
The Security.io assessment
This older incident remains in today’s edition because fresh reporting materially clarified the operating posture: services were restored, UNM said it made no concessions, the FBI investigation continued and data-theft scope remained unresolved. That creates a useful executive distinction between successful continuity actions and incomplete security closure.
UNM’s statement that core systems and servers were not penetrated is an organisational assessment, not independently published forensic evidence. It should be reported with attribution. The unverified ransomware claim does not establish encryption, theft or actor responsibility, while the documented ambulance and outpatient disruption is sufficient to justify a resilience review.
Questions for the morning meeting
- What clinical services can operate safely when endpoint access is unavailable?
- Which evidence supports the conclusion that core systems were not penetrated?
- Can restored endpoints be distinguished from forensically cleared endpoints?
- Who decides when patient-safety disruption requires executive or regulator escalation?