UNM Health cybersecurity incident — ambulances diverted, clinics shut across New Mexico's only Level 1 trauma center
Severity: high · Patch status: no-fix-needed · Since 2026-10-26
On October 26, 2026, the University of New Mexico Health System suffered a cybersecurity incident detected around 11 a.m. that forced it to divert all ambulance traffic, cancel appointments across 30+ clinics, suspend outpatient surgeries, and temporarily stop accepting new patients. UNM operates New Mexico's only Level 1 trauma center, so its closure put pressure on regional hospitals; Presbyterian Healthcare Services and Lovelace Health System absorbed diverted patients. IT teams contained the threat, which affected some end-user devices but did not reach core systems or servers. An Emergency Operations Center was activated, outside support engaged, and state and federal law enforcement notified. Systems were restored by the next day. Employees reported messages claiming patient, student, and staff data was stolen, but UNM has not confirmed this, and the incident remains under criminal investigation. UNM warned of phishing attempts exploiting the incident.
What to do
- Monitor for phishing and fraud attempts referencing the UNM incident; warn staff and patients
- Verify whether patient, student, or staff data was exposed and prepare breach notifications if confirmed
- Review endpoint detection and network segmentation to keep end-user compromises off core systems
- Validate incident response and downtime procedures for emergency care diversion and clinic closures
- Coordinate with regional hospitals on surge and diversion plans for trauma-capable facilities
Sources
All live incidents on Threat Watch
