UNM Health cyberattack interrupts ambulance traffic and outpatient care
A cyberattack disrupted UNM Health care on October 26. UNM reports clinical services restored October 27 and classes/research resumed October 28. Its assessment limits impact to endpoint devices rather than core servers. Data-theft claims remain unverified.
- Disclosed
- Oct 26, 2026
- Updated Oct 28, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- UNM Health patients and HSC staff/students; attack prerequisites and affected-device count are undisclosed
- healthcare · outage
- In the wild
- Not applicable
- Confirmed cyberattack; no specific software vulnerability disclosed.
What happened
UNM says the incident forced ambulance diversion and canceled outpatient care. That clinical disruption warrants L4. Byod claims a much broader intrusion and data theft; UNM instead says core systems were not penetrated. Neither a patient-data total nor ransomware attribution is confirmed.
On October 28, UNM confirmed classes and research had resumed, with clinical operations fully functional, and said it made no concessions to the group behind the threat. Its warning about follow-up scams does not confirm the attackers’ data-theft claims.
Crime-scene timeline
Oct 26, 2026
UNM discloses care disruption
Oct 27, 2026
UNM reports clinical systems and ambulance operations restored
Oct 28, 2026
Classes and research resume; UNM warns against follow-up scams
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- UNM HSC incident updatesPrimaryOctober 26 disclosure, October 27 clinical restoration and October 28 academic recovery/scam guidance; endpoint-only assessment.
- BleepingComputerReports Byod claims that UNM has not corroborated; recommends phishing vigilance.