{
  "id": "unm-health",
  "url": "https://ohshit.app/incidents/unm-health/",
  "title": "UNM Health cyberattack interrupts ambulance traffic and outpatient care",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-26",
  "date_is_approximate": false,
  "updated": "2026-10-28",
  "tags": [
    "healthcare",
    "outage"
  ],
  "ecosystems": [],
  "summary": "A cyberattack disrupted UNM Health care on October 26. UNM reports clinical services restored October 27 and classes/research resumed October 28. Its assessment limits impact to endpoint devices rather than core servers. Data-theft claims remain unverified.",
  "splash": "UNM Health patients and HSC staff/students; attack prerequisites and affected-device count are undisclosed",
  "wipe": "Contact your clinic about missed care; follow UNM notices and treat breach-themed messages cautiously",
  "in_the_wild": "n/a",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Confirm rescheduled care with your clinic",
      "hint": "Contact your care team to reschedule a disrupted appointment or procedure; UNM says its teams will work with affected patients."
    },
    {
      "title": "Check official HSC operating notices",
      "hint": "UNM says HSC classes and research resumed October 28 and clinical operations are fully functional; central and branch campuses were unaffected."
    },
    {
      "title": "Watch for unsolicited breach messages",
      "hint": "Do not engage anyone claiming responsibility, click their links, open attachments, download files or give personal/financial information. Preserve the message and report the contact to IC3.gov or 1-800-CALL-FBI; verify other requests through known UNM channels."
    }
  ],
  "sources": [
    {
      "name": "UNM HSC incident updates",
      "url": "https://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hsc",
      "says": "October 26 disclosure, October 27 clinical restoration and October 28 academic recovery/scam guidance; endpoint-only assessment.",
      "primary": true
    },
    {
      "name": "BleepingComputer",
      "url": "https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/",
      "says": "Reports Byod claims that UNM has not corroborated; recommends phishing vigilance.",
      "primary": false
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Confirmed cyberattack; no specific software vulnerability disclosed.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 26, 2026",
      "title": "UNM discloses care disruption"
    },
    {
      "date": "Oct 27, 2026",
      "title": "UNM reports clinical systems and ambulance operations restored"
    },
    {
      "date": "Oct 28, 2026",
      "title": "Classes and research resume; UNM warns against follow-up scams"
    }
  ],
  "body_markdown": "UNM says the incident forced ambulance diversion and canceled outpatient care. That clinical disruption warrants L4. Byod claims a much broader intrusion and data theft; UNM instead says core systems were not penetrated. Neither a patient-data total nor ransomware attribution is confirmed.\n\nOn October 28, UNM confirmed classes and research had resumed, with clinical operations fully functional, and said it made no concessions to the group behind the threat. Its warning about follow-up scams does not confirm the attackers' data-theft claims."
}