UNM Cyber Event Diverts Ambulances, Shuts Clinics

A cybersecurity event at the University of New Mexico Health Sciences Center forced the university’s health system to divert ambulances, cancel the day’s clinic appointments and send students home on Monday 26 October. By late evening, UNM said its hospitals were open again and clinics would resume normal appointments on Tuesday, but classes on the health campus remain cancelled.

UNM has not said what kind of attack it was, what systems were hit, or whether any data was taken. It says that “because this remains an active law enforcement investigation, we are limited in what we can share at this time.”

How Monday unfolded

The university’s IT status service first flagged a “cybersecurity issue affecting UNM Health Sciences Center services” from 11:30am local time (17:30 GMT). It said some systems at the centre were affected, that staff there might lose access to some university-wide services, and that main and branch campus systems were not affected.

At 2:30pm, UNM Health said all ambulance traffic was being diverted to other hospitals and all of that day’s clinic appointments were cancelled. It told patients not to come to its facilities, to call 911 in an emergency and to put off anything else. Non-essential staff and all students at the School of Medicine and the colleges of Pharmacy, Nursing and Population Health were told to leave campus.

In an update at 6:08pm, the Health Sciences Center said it “experienced a cybersecurity event”. Its IT security teams moved to contain it, notified state and federal law enforcement and brought in outside partners to help investigate. Leaders opened an Emergency Operations Center. Between 12:30 and 2:30pm, UNM Health limited the new patients it would accept, with health systems in Albuquerque and Santa Fe taking up the slack. System outages also forced it to suspend outpatient surgeries and appointments for the rest of the day. From 2:30pm, it began bringing systems back online in phases.

The 10:27pm update said UNM Hospital and Sandoval Regional Medical Center were open and that clinics would run their regular appointments and procedures on Tuesday 27 October. Classes at the four health schools and colleges are cancelled on Tuesday, and non-essential Health Sciences Center staff have been asked to stay at home.

The FBI is assisting, and a data claim is unconfirmed

The Associated Press, in a report carried by SecurityWeek, quoted FBI spokesperson Margot Cravens in Albuquerque as saying the agency was “assisting our partner”. The AP also reported that several UNM Health employees said they heard messages across their computers on Monday morning claiming that student, employee and patient data had been stolen. Albuquerque station KOB 4 said it had obtained a partial recording of such a message. Officials have not confirmed those claims, and UNM’s own statements make no mention of data theft. A UNM main campus spokesperson, Steve Carr, told KOB the threat was confined to the Health Sciences Center.

One system carries the state’s top trauma care

The disruption mattered beyond UNM because of where the hospital sits in New Mexico’s emergency care. According to the AP, UNM Hospital runs the state’s only Level 1 trauma centre, the highest tier for the most serious injuries, so diverting ambulances left New Mexico for a time without a department equipped for them. The AP reported that Presbyterian Healthcare Services and Lovelace Health System were coordinating with UNM and taking extra patients.

That is the pattern hospital attacks have shown before: the harm is often operational first and a data problem second. Diversion and cancelled surgeries are visible within hours. The question of what was taken, and from whom, can take months, as the Alliance Medinet breach and the Quest Diagnostics case both showed. Public bodies hit by attackers, such as the city of Columbia, South Carolina, have also tended to say little while police are involved.

Recovery speed is the early test

UNM’s response so far has been fast by hospital standards: it moved from diversion to reopening in under a day, kept main campus systems separate, and kept patients informed through three dated updates. The academic side is moving more slowly, with health classes, including online ones, cancelled for a second day, which suggests that staff and student systems are being treated with more caution than clinical ones.

The open questions are the ones UNM has declined to answer. Patients, staff and students will want to know whether the messages heard on Monday were bluster or a sign of real data loss. In the US, a health provider that finds patient data was compromised generally has to notify the people affected. Until UNM says more, anyone who used its services should be wary of calls or emails that mention the incident and ask for personal details.