Cyberattack diverts ambulances from New Mexico's only Level I trauma center

Systems restored, clinics resume

UNM Health said on Tuesday 27 October that all critical electronic systems were back online, ambulance traffic had returned to normal and clinics had resumed scheduled appointments and procedures. In a 2:02 p.m. update, the university said all UNM Health hospitals were fully open. UNM Hospital in Albuquerque and Sandoval Regional Medical Center had remained open throughout the disruption, the health system said.

Care teams are rescheduling missed appointments and procedures. Classes at the four health sciences schools were canceled on Tuesday, and academic and research programs were expected to resume on Wednesday. UNM told people with emergencies to call 911.

Two-hour diversion

The disruption began on Monday 26 October. IT security teams started containment around 11 a.m. after identifying a threat, according to UNM's updates. From 12:30 p.m. to 2:30 p.m., UNM Health diverted ambulance traffic to other area health systems and limited new patient intake. Outpatient surgeries and appointments were canceled for the rest of the day.

The diversion involved UNM Hospital, which houses New Mexico's only Level I trauma center. UNM activated its Emergency Operations Center and notified state and federal law enforcement. Nonessential Health Sciences Center employees were told to stay home. At 2:30 p.m., UNM began bringing systems back online in phases.

A Level I trauma center keeps surgeons and specialists available around the clock for major crashes, gunshot wounds and serious falls. When it goes on diversion, paramedics must take patients to other emergency departments, which may need to stabilize the sickest patients and then arrange transfers. UNM Health handles more than 1 million patient visits a year. Its flagship hospital sees about 80,000 emergency room patients a year, BankInfoSecurity reported. UNM Health Sciences Center is the state's only academic medical center. Smaller hospitals across New Mexico rely on it to accept critically injured and ill patients. No harm to any patient during the diversion has been reported.

What UNM has confirmed

UNM said the incident affected some end-user devices but did not penetrate core systems or servers. It credited IT security teams working with external partners for the quick recovery. The university also thanked health systems in Albuquerque and Santa Fe for absorbing patients during the diversion.

Ransomware claims remain unverified

A group calling itself Byod claimed on its dark-web leak site that it had compromised 36,000 systems across UNM's main campus and hospital environments. The group listed Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant and two Oracle databases. It claimed access to student and employee personal data, including Social Security numbers, HR, payroll and Banner student records, internal emails, research data, hospital appointment data, patient information and Cerner EHR rosters.

None of those claims has been independently confirmed. UNM did not disclose the type of cyberattack. BleepingComputer reported that it found the Byod claim. Ransomware groups often overstate what they took to pressure victims into paying. UNM's finding that core servers were not reached does not by itself rule out data copied from individual devices.

KOB 4 reported that an automated audio message played on hospital workers' computers told administrators to contact the attackers and claimed they held Social Security numbers. Byod's leak site lists six victims, and the group has published data it says came from three of them.

Byod said it would provide free decryption keys for locked systems at healthcare facilities and pay up to $2,500 for every patient affected. The group also said it would keep all the stolen data.

"We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data," the group said.

On its FAQ page, Byod calls its work "pentesting" and says the aim is to expose vulnerabilities and hold data controllers accountable for breaches.

Byod said it would take down its breach post once the university began communicating with the group, which BleepingComputer reported was likely ransom negotiations. BleepingComputer asked UNM Health Sciences for comment on the theft allegations and received no response.

Prior breach

UNM Health has faced a major breach before. In 2021 it reported a hacking incident that affected 637,300 people and potentially exposed names, addresses, birth dates, insurance information and Social Security numbers, according to BankInfoSecurity.

What happens next

UNM has released few details because of the criminal investigation. Patients and staff were advised to remain vigilant for unsolicited communications and phishing attacks.