University of New Mexico Health began diverting ambulance traffic and cancelled appointments at more than 30 clinics on Monday after a network intrusion, leaving the state without a working emergency department for its most severe cases. Its hospitals reopened in phases the same day and clinics were due to resume on Tuesday.
The health system runs New Mexico’s only Level 1 trauma centre and handles roughly 900,000 outpatient and 100,000 emergency visits a year. Presbyterian Healthcare Services and Lovelace Health System said they were coordinating with UNM and accepting additional patients.
Hackers spoke through the workstations
Employees working late Monday morning heard a message play across their computers claiming that student and employee records, patient information and Social Security numbers had been taken. The intrusion was detected around 11:30 a.m., and staff were told roughly 40 minutes later to shut systems down, unplug them and kill Wi-Fi on mobile devices.
A group calling itself BYOD claimed the attack on a Tor leak site, asserting control of 36,000 machines across the campus and hospital, two Oracle databases, an Entra tenant, HR and payroll systems, Banner student records and Cerner EHR rosters. None of that has been verified.
UNM Health has declined to discuss specifics, citing an active law enforcement investigation. The FBI’s Albuquerque office said it is assisting but would not elaborate.
Planning lessons
The episode shows where downtime rules now sit. Ambulance diversion is a load-balancing decision made by the receiving hospitals, not the victim, so regional providers need standing agreements before an incident, along with a paper fallback for the trauma pathway and an assumption that the first visible signal may arrive as a voice on clinical workstations.
