UNM Health cybersecurity issue forces clinic closures and ambulance diversion

The University of New Mexico Health System canceled all clinic appointments on Monday, October 26, 2026, told patients not to show up at its main hospital in Albuquerque, and diverted ambulances to other hospitals over a cybersecurity issue it said teams are working to resolve. The system operates more than 30 clinics and the state's only Level 1 trauma center, and the Associated Press reported that the diversion left New Mexico without an emergency department capable of treating the most serious injuries. UNM Health conducts about 900,000 outpatient visits and receives about 100,000 emergency room visits a year. Its Health Sciences Center, the state's largest academic medical center, canceled classes and closed for the day.

UNM Health's release did not say what caused the issue, whether patient information was exposed, or when ambulance service and appointments will resume. Officials said anyone facing an emergency should call 911 and that patients with non-emergency needs should put off care until further notice. No record count has been stated, so this is prepared as a Cybersecurity item, not a Breaches add.

Update, October 26 (evening): Sourcing note: this update rests on a single source chain, UNM Health's own updated statement, published through its Health Sciences Center Newsroom as of 6:08 PM MT on October 26 and verified at source by SecurTek's dedicated incident watch; ABQ RAW reports the same advisory, but its article page could not be opened in full in this cycle. The update will be revised when independent reporting confirms or revises it. UNM says containment steps were taken, state and federal law enforcement were notified, and external partners were engaged. Acceptance of new patients was limited only from 12:30 PM to 2:30 PM, outpatient surgeries and appointments stayed suspended for the rest of October 26, and operations began resuming in phases at 2:30 PM. The Health Sciences academic and research units remain closed on Tuesday, October 27, with all classes canceled, while Hospital and Medical Group staff return Tuesday, and a further update on Tuesday outpatient services was promised for later that night or early Tuesday morning. The cause, any ransomware involvement, and any data exposure are still not stated.

Further update, October 26 (late): Sourcing note: this update rests on a single reporting chain, an Associated Press report published by SecurityWeek on October 26, 2026 at 7:30 PM MT, and it will be revised when a second independent source confirms or revises it. The Associated Press reports that multiple UNM Health System employees said they heard messages across their computers while working late Monday morning that claimed to have stolen student and employee data and patient information. The messages are an attacker claim reported by employees; UNM Health has not confirmed that data was stolen, and the Associated Press report does not confirm data exposure or ransomware. A UNM Health spokesperson would not comment, citing the active law enforcement investigation. FBI spokesperson Margot Cravens in Albuquerque said the agency was assisting its partner but declined further comment. Presbyterian Healthcare Services and Lovelace Health System said they were coordinating with UNM Health, including taking additional patients. UNM Health had still not published a Tuesday outpatient update on its Health Sciences Center Newsroom page as of the dedicated watch check at 9:30 PM MT, and the cause, any ransomware involvement, and any data exposure remain not confirmed by UNM.

Further update, October 26 (resumption): Sourcing note: this update rests on a single source chain, UNM Health's own updated statement, published through its Health Sciences Center Newsroom as of 10:27 PM MT on October 26, 2026 and verified at source this cycle. The update will be revised when independent reporting confirms or revises it. UNM says its information technology security teams continue working to resolve the cybersecurity event. All UNM Health hospitals, UNM Hospital and SRMC, are open, and all clinics will resume regularly scheduled appointments and procedures on Tuesday, October 27, 2026. Classes at the UNM School of Medicine, College of Nursing, College of Pharmacy and College of Population Health are canceled Tuesday, while classes at UNM central and branch campuses are not affected. Nonessential Health Sciences Center employees are asked to remain home Tuesday, and essential and clinical employees, along with students with clinical responsibilities, should report to their usual work or clinical locations. The 10:27 PM update does not state the cause, whether ransomware is involved, or whether data was exposed.

Further update, October 27: UNM Health Sciences Center said as of 2:02 PM MT on October 27 that critical electronic systems are back online, all UNM Health hospitals are fully open, ambulance traffic has returned to normal, and clinics have resumed regularly scheduled appointments and procedures. UNM says containment began around 11 AM on October 26, and its assessment determined the event affected some end-user devices but did not penetrate core systems or servers.

Health Sciences classes remain canceled Tuesday, and all HSC academic and research programs should resume normal operations Wednesday. UNM says the incident remains under criminal investigation; the cause, whether ransomware is involved, and whether data was exposed are still not stated, and the finding that core systems were not penetrated does not by itself rule out exposure from affected end-user devices.

Update, October 28: UNM Health Sciences Center said as of 12:39 PM MT on October 28 that classes and research have resumed and clinical operations across all UNM Health facilities are fully functional. UNM states it made no concessions with any group behind the threat. UNM also warns that those responsible may attempt false payment or compensation scams, and directs patients, students, employees, and community members not to engage and to report such contact to the FBI at IC3.gov or 1-800-CALL-FBI. The cause, whether ransomware is involved, and whether data was exposed are still not stated.

Sources: The Paper.; Associated Press via The Reflector; ABQ RAW; Associated Press via SecurityWeek; UNM HSC Newsroom