A cyberattack on the University of New Mexico Health Sciences Center forced UNM Health to divert ambulances away from its hospitals, cancel appointments and outpatient surgeries at more than 30 clinics, and send nonessential staff and health sciences students home on Monday, October 26, 2026. The health system runs New Mexico’s only Level 1 trauma center at UNM Hospital in Albuquerque.
UNM Health said its hospitals reopened and that clinics would resume regularly scheduled appointments and procedures on Tuesday, October 27, while security teams continue to work on the incident. Classes at the Health Sciences Center remain canceled on Tuesday. This article reflects information available at the time of publication.
Ambulances turned away from the state’s top trauma hospital
In its first public notice at 2:30 p.m. Mountain Time on Monday, UNM Health said all ambulance traffic was being diverted to other hospitals and that all clinic appointments for the day were canceled. The notice told patients not to come to UNM Health facilities that day, to call 911 for emergencies and to delay non-emergency care until further notice.
The diversion included Sandoval Regional Medical Center, according to local reporting. A later statement said UNM Health limited its acceptance of new patients from 12:30 to 2:30 p.m. and thanked health systems in Albuquerque and Santa Fe for taking patients during that window. “System outages” also forced the cancellation of outpatient surgeries and appointments for the rest of the day.
Because UNM Hospital is the only Level 1 trauma center in New Mexico, the diversion briefly left the state without its main hospital for the most serious injuries. The health system said it will work with patients to reschedule missed appointments and procedures.
Staff told to unplug computers and switch to paper
The Daily Lobo, UNM’s student newspaper, reported that administrators messaged healthcare workers shortly after noon on Monday telling them to turn off and unplug desktop computers, disable Wi-Fi on mobile devices and continue working with paper forms. That kind of rapid shutdown is a common containment step meant to stop malicious code from spreading across a hospital network.
UNM HSC said its IT security teams “immediately took steps to contain the event and protect the network,” notified state and federal law enforcement and brought in external partners to help with the investigation. Leadership also activated an Emergency Operations Center to coordinate the response. At 2:30 p.m., UNM Health began bringing systems back online in phases.
A UNM main campus spokesperson told KOB 4 that the incident is limited to the Health Sciences Center and is not university-wide. Classes on UNM’s Central and branch campuses are not affected.
Extortion message played on hospital workstations
According to a partial recording obtained by KOB 4, an automated voice message played on hospital workers’ computers urged administrators to contact the attackers on Session, an encrypted messaging app. The message threatened lawsuits and closure and claimed the attackers held student and employee data, Social Security numbers, private documents and emails. KOB also reported that a red skull image with the words “Oh no, you have been compromised” replaced employee screens.
UNM officials have not confirmed the authenticity of the message or any of its claims. A recently surfaced data-extortion group has since listed the university on its leak site and claims to have taken student, employee, HR, payroll and research data from UNM systems. These claims are unverified.
What UNM has not said yet
UNM Health has not described the event as ransomware, has not confirmed any data theft and has not said whether its electronic health record system was affected. It also has not given a timeline for full restoration of all systems. “Because this remains an active law enforcement investigation, we are limited in what we can share at this time,” the Health Sciences Center said in its official update.
The New Mexico Governor’s Office had not issued any public statement on the incident at time of publication.
Hospitals remain a prime extortion target
Attacks that knock clinical systems offline have repeatedly forced hospitals onto paper and into ambulance diversion. In May 2024, a ransomware attack on Ascension disrupted electronic health records across its national network for weeks and led several of its hospitals to divert ambulances. Smaller providers face the same pressure, as seen when Mile Bluff Medical Center disclosed a cyberattack that disrupted core systems.
Academic medical centers are especially exposed because research, teaching and patient care often share infrastructure and identity systems. The University of Illinois Chicago confirmed a ransomware attack on its College of Medicine, and large public hospital systems such as NYC Health + Hospitals have reported data breaches affecting millions of people.
What patients and students should do now
- Patients with appointments or procedures should watch for direct contact from UNM Health about rescheduling.
- Anyone needing emergency care should call 911.
- Students, staff and patients should be cautious of calls, texts or emails that reference the incident and ask for passwords, payment or personal details.
- Watch for official notices from UNM about whether personal data was involved before taking steps such as a credit freeze.
BreachNews will update this story as UNM Health shares more about the cause, the scope of any data exposure and the restoration of its systems.
