Cybersecurity Incident at UNM Health Disrupts Clinical Operations and Forces Ambulance Diversions

What Happened

A cybersecurity incident at the University of New Mexico Health System disrupted operations across one of the state’s most important healthcare environments on October 26. The incident forced ambulance diversions from UNM Hospital, led to appointment cancellations across more than 30 clinics and temporarily disrupted activities across the UNM Health Sciences Center.

The operational impact is particularly significant because UNM Hospital operates New Mexico’s only Level I Trauma Center and the health system handles more than one million patient visits annually. Other healthcare providers in the region coordinated to absorb additional patient demand while UNM Health gradually restored operations.

At this stage, UNM Health has not publicly confirmed the root cause of the incident, ransomware involvement or a verified data breach. The investigation remains active, with law enforcement and the FBI involved. The distinction matters: the operational disruption is confirmed, while the technical mechanism and full scope of the incident remain under investigation.

Why This Incident Matters

In healthcare, a cybersecurity incident can quickly move beyond IT and affect the delivery of medical services.

The impact in this case was not limited to unavailable systems. Disruption to the digital environment affected ambulance routing, appointments and the distribution of patients across other healthcare facilities.

This demonstrates why cyber resilience in healthcare must include not only protection against compromise, but also the ability to maintain critical clinical operations when parts of the IT environment become unavailable or cannot be trusted.

From Cybersecurity to Continuity of Care

Modern hospitals depend on interconnected systems supporting electronic medical records, laboratories, medical imaging, identity and access management, communications, network infrastructure, clinical applications and administrative processes.

An incident affecting one part of this environment may require systems to be isolated or access to be restricted while investigators contain the threat. This is why incident response must be closely connected to business continuity and disaster recovery planning.

Healthcare organizations therefore need to understand not only whether they can detect an attack, but also:

• which clinical services must continue during IT disruption;

• which systems must be restored first;

• which technical dependencies could delay recovery;

• how clinical teams operate with limited access to digital services;

• who has authority to isolate systems and activate emergency procedures;

• when a recovered system can safely return to production.

What Healthcare Organizations Should Review

The first priority is to identify the systems that healthcare delivery actually depends on, rather than defining criticality only from an IT perspective.

Organizations should then verify whether practical procedures exist for operating when those systems are unavailable. This includes alternative clinical workflows, clearly defined responsibilities, reliable backups, tested recovery capabilities and effective coordination between IT, cybersecurity teams, clinicians and leadership.

Regular testing is equally important. A recovery plan that has never been exercised under realistic conditions provides limited assurance about how the organization will perform during an actual incident.

DIAMATIX Comment

The UNM Health incident demonstrates why cybersecurity and operational resilience cannot be managed as separate disciplines in healthcare.

Detecting the threat is only the first step. The organization must then contain the incident quickly, maintain visibility across the environment, determine which systems can safely continue operating and restore critical services in the correct order.

This requires continuous monitoring, clearly defined response procedures, reliable recovery capabilities and pre-established coordination between technical and clinical teams.

For a healthcare organization, response time is not only a Security Operations Center (SOC) performance metric. It can directly influence the continuity of medical services.

Contect DIAMATIX

Healthcare in Practice: BULPHARMA

A similar operational approach underpins the work between BULPHARMA Healthcare Group and DIAMATIX, where more than 1,600 endpoints and 35+ servers across a distributed healthcare environment are supported through MDR 360° powered by DIAMATIX SOC. The model combines 24/7 monitoring, Endpoint Detection and Response (EDR), SHIELD SIEM/XDR, backup and disaster recovery within one security and resilience framework.

The objective is not only faster threat detection. It is to maintain visibility and response capability across an environment where the availability of critical medical systems is directly connected to operational continuity.

Read the BULPHARMA MDR 360° case study

Practical Takeaway

The UNM Health incident shows how a cybersecurity event in healthcare can reach the organization’s primary mission: delivering medical care.

Readiness therefore needs to cover the entire operational cycle:

visibility → detection → containment → continuity of critical services → recovery → safe return to normal operations.

Review whether your cyber incident response plan defines not only how an attack will be contained, but also how critical healthcare services will continue while the incident is being managed.

Sources

• Associated Press. A cybersecurity issue forces a major New Mexico hospital to divert patients and close clinics, 26 October 2026.

• UNM Health System. Official information on UNM Health and its Level I Trauma Center.

• DIAMATIX. BULPHARMA Improves Response Time and Visibility with MDR 360° powered by DIAMATIX SOC, July 2026.