UNM Health says ambulances were diverted for two hours; ransomware, data theft and a recovery date are not stated

Two hours of diversion, and 27 hours before UNM said critical systems were back

The University of New Mexico says its Health Sciences Center (HSC) diverted ambulance traffic from 12:30 to 2:30 p.m. on Monday 26 October 2026. That is 120 minutes (derived). It also says its IT security teams began containment "around 11 a.m.", so the diversion began 90 minutes after containment did (derived). The newest version of its notice, stamped 2:02 p.m. on Tuesday 27 October, says critical electronic systems are back online, which is 27 hours 2 minutes after containment began (derived), and that classes at four HSC schools stay cancelled for a second day.

The same notice makes a claim that has to be held next to those numbers. UNM says its assessment found that the event affected some end user devices but "did not penetrate core systems or servers". That is the affected organisation's early view, inside what it calls a criminal investigation. It does not establish that no data was taken, and the notices never say whether any was. They do not say whether this was ransomware, who is responsible, how access was gained or when it began. A ransomware group has claimed the attack, as relayed by two news outlets. That is an allegation, and it is covered below.

This briefing reads UNM's own pages first: the newsroom notice, which carries four time stamped versions on one page, and the university's IT Alerts record. The news coverage (The Record, Infosecurity Magazine and KOB 4) is secondary and is used for what outsiders report and for the group's claim. The Register's report of the second day was not read. Its robots.txt allows named search and AI assistant crawlers and denies the rest by default, and this site's research agent is not on that list, so it was not requested. Nothing was read from the group's own site, and nothing was filled in or submitted. UNM is the source of nearly every fact below and is also a party with legal and reputational exposure, so its wording is read as that of an interested party.

What UNM says happened, and when it first said it

The notice on UNM's HSC newsroom page is one page that is rewritten as the incident moves. Its four versions are headed 2:30 p.m. and 6:08 p.m. on Monday and 10:27 p.m. on Monday, with the latest stamped 2:02 p.m. on Tuesday. The IT Alerts record on the main university site adds a start time of 11:30 am and says that main campus and branch campus systems are not affected "at this time". The diagram puts each stated time on one scale.

Zoom

Two derived gaps matter for a reader who wants to know how fast the public was told. The earliest dated version of the notice is headed 2:30 p.m., 3 hours 30 minutes after containment began (derived). The IT Alerts record carries a date field of 202610261523, which reads as 3:23 pm (derived, zone not stated), 4 hours 23 minutes after containment began (derived). Neither page says when the first notice was actually posted, so these are the earliest times the pages themselves carry, not proven posting times.

The access window is not stated. The notices say containment began around 11 a.m. after the threat was identified, and say the team acted "immediately" in the 6:08 p.m. version. They do not say when the threat was first present on the network, how it was identified, or how long it had been there. For a breach, those are the dates a reader needs, and they are absent.

What was down and what is working, as UNM states it

The stakes are set by UNM's own homepage, which calls UNM Health "New Mexico's only Level I Trauma Center", and by Infosecurity Magazine, which reports more than one million patient visits a year at HSC. The table sets each area against what UNM says and does not say.

Two things are worth separating. UNM says core systems and servers were not penetrated, and it also says outages forced it to suspend outpatient surgery for the rest of the day. If only some end user devices were affected, the cost was still a day of lost clinical work, which suggests (inference) that the end user devices are how clinicians reach the systems behind them, and that shutting them was the response. UNM does not say that.

Cause, attacker and data: stated and not stated

This is the table the incident most needs, and it is mostly the negative column. UNM uses the words "cybersecurity event", "cybersecurity threat" and "cybersecurity issue" across its notices. It uses "incident" once, in the sentence saying the matter is under criminal investigation, and never uses the words ransomware, breach or attack. The Record says a UNM spokesperson did not respond to requests about whether ransomware was involved.

This is where the friendly name does the work of a control. A label such as "end user devices" sounds small, and "did not penetrate core systems" sounds like a boundary that held. Neither describes what the attacker could read or take from the devices it did reach, and neither says how much of clinical work was running. The Record reports, citing local outlets, that staff received a phone alert to turn off and unplug desktops and to disconnect mobile devices from the hospital Wi Fi. UNM's notices do not print that instruction. KOB 4 quotes a student saying a department head advised turning university computers off. If both are accurate, a protective shutdown of the clinical front end may be why the day was lost, which would be a decision and not a limit of the attack (inference).

Zoom

Three wordings of one two hour window

The newsroom page keeps its earlier versions, which lets the wording be compared. The first notice says "all ambulance traffic is being diverted to other hospitals". The 6:08 p.m. version says UNM Health "temporarily limited its acceptance of new patients" from 12:30 to 2:30 p.m. The Tuesday version says it "temporarily diverted ambulance traffic to other area health systems". The three can describe the same two hours, and the page does not say so.

Zoom

There is also a timing collision. The first notice is headed 2:30 p.m. and says diversion is under way, while the later versions say diversion ended at 2:30 p.m. and restoration began then. The page does not say when the first notice was posted, so it is not an error that can be pinned on anyone. It does mean that a reader at 2:30 p.m. Monday could not tell from the page whether ambulances were still being turned away. A hospital that publishes a time stamped diversion notice should give its neighbours the minute the diversion ended, as well as the minute it began.

A group's claim, a screen message, and what each would need to be true

The Record says a ransomware gang known as BYOD took credit on Monday evening, claiming to have compromised 36,000 machines on the university's main campus and hospital and to have stolen information on students, patients and employees. The Record also says BYOD is a new gang that emerged last month with a handful of named victims. Infosecurity Magazine says a threat intelligence firm reported on X that the group listed UNM on its data leak site, claiming 36,000 machines and stolen data that allegedly includes student and employee personal information, research data, student records and internal emails. Both are allegations, relayed second hand. This briefing did not read the group's site or the posts.

The two accounts differ on one point. The Record's version of the claim includes patients. Infosecurity Magazine's list does not. Which wording the group used is not established here, and the difference matters because patient data brings different notification duties from student data.

KOB 4 reports a separate item, a partial recording it obtained of an automated voice and a red skull image on employee screens, which it says officials have not confirmed. It reports that the message claimed possession of student and employee data including Social Security numbers and told the reader to make contact through a messaging app. The text is not reproduced here. It is an unverified recording passed to a television station, and nothing in it is an indicator a defender can use.

A claim is not a confirmed fact. See Q3's 2,627 ransomware claims, 247 confirmed by the victim for the gap between claimed and confirmed victims across a quarter. The claim of 36,000 machines also sits oddly against UNM's own text. The IT Alerts record says main campus and branch campus are not affected at this time, while The Record places the machines on the main campus and hospital. UNM gives no device count, so the two cannot be compared. If the figure were true, it would imply a much larger estate than "some end user devices" suggests (inference). A similar situation is analysed in the Ahold Delhaize brief, where a company's wording and an operator's remarks diverged.

What patients, staff and students were told, and what they were not

The omission that stands out is the patient one. UNM's notices give patients an instruction about where to go and nothing about their information. That may be right while an investigation is open. It also leaves every patient, and every student and employee, in the dark about the one question that decides what they should do next.

The previous time, and a regional comparison

UNM Health disclosed a different incident in 2021. The HIPAA Journal, in a report of 17 August 2021, says an unauthorised third party accessed its network on 2 May 2021, UNM discovered it on 4 June 2021, and breach letters began on 3 August 2021. That is 33 days from access to discovery, 60 days from discovery to letters, and 93 days from access to letters (derived). The report says up to 637,252 patients were affected, per a report to the US Department of Health and Human Services' Office for Civil Rights. That is a separate event, read here only from a secondary source, and nothing links it to this one. It shows how long the gap can run between a network being touched and a patient being told.

The Record adds that this is the second major cyberattack on a large state hospital this year, after the one at the University of Mississippi Medical Center in March, which it says caused chaos in that state for weeks and limited operations at its only children's hospital and only Level I trauma centre. That is The Record's account and was not checked against a primary source.

Technical details

UNM's notices and its IT Alerts record print no indicator of compromise: no hash, domain, address, malware name, ransom note text, command line or configuration. Nothing is invented here to fill that gap. The one machine readable artifact on UNM's own pages is the data of the IT Alerts record for this incident, copied below with the author field left out.

"subject":"Cybersecurity Issue Affecting UNM Health Sciences Center Services 10/26"
"type":"Announcement"
"period_start":"20261026","start_time":"11:30 am","period_end":"Present"
"date":"202610261523"
"status":"Current"

What a defender does with it: it shows the time the university itself recorded for the start of the issue (11:30 am) set against the time of the record's own date field (3:23 pm if read as hours and minutes), which is 3 hours 53 minutes later (derived). It is not an indicator. Do not read the date field as the time of posting without confirmation, because the page labels no zone.

CISA's #StopRansomware Guide is the public baseline for the isolation decision UNM appears to have made, whatever the cause turns out to be. The lines below are as the guide prints them, read on 27 October 2026. UNM has not said this was ransomware, and these lines are not claimed to describe what UNM did.

If several systems or subnets appear impacted, take the network offline at the switch level. It may not be feasible to disconnect individual systems during an incident.
Power down devices if you are unable to disconnect them from the network to avoid further spread of the ransomware infection.
Note: This step will prevent your organization from maintaining ransomware infection artifacts and potential evidence stored in volatile memory.

The trade the guide describes is the one a hospital faces: powering off protects other systems and loses volatile memory evidence. A responder who is deciding what to preserve should settle that before the switch is thrown, because it cannot be undone afterwards.

A ranked checklist for a hospital's downtime

The order follows what the record shows: the clinical loss came from a response to a threat on end user devices, so the first work is the work of running care without them. Items 2 to 6 rest on CISA's #StopRansomware Guide. The rest are this site's suggestions, untested, and each should be rehearsed before it is relied on.

The closing question is for whoever owns the clinical risk. UNM says core systems and servers were not penetrated. Then what stopped outpatient surgery for the rest of Monday, and could your hospital answer that for itself?

Key facts