UNMH Back in Business After Cybersecurity Threat, Unclear if UNMH Paid Ransom

According to UNMH officials, critical electronic systems at The University of New Mexico Health Sciences Center (HSC) are back online following Monday’s cybersecurity event. All UNM Health hospitals are fully open, ambulance traffic has returned to normal operations, and clinics have resumed regularly scheduled appointments and procedures.

Information technology security teams began containment efforts around 11 a.m. Monday, Oct. 26, after identifying a cybersecurity threat. Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers. Teams worked with external partners to secure the network and notified state and federal law enforcement.

UNM Hospital leadership activated the Emergency Operations Center to coordinate the response and provide guidance to employees, students and clinical teams.

Clinical Response

From 12:30 to 2:30 p.m. Monday, UNM Health temporarily diverted ambulance traffic to other area health systems while security teams worked to protect the network. System outages also required the suspension of outpatient surgeries and appointments for the remainder of the day.

UNM Health began restoring operations at 2:30 p.m. Monday, bringing systems back online in phases as it was safe to do so. Care teams will work with patients to reschedule appointments and procedures affected by the disruption.

UNMH said electronic systems restored and normal ambulance operations resumed, UNM Health’s focus is on supporting patients and our frontline healthcare workers.

Academic Response

Classes at the UNM School of Medicine, College of Nursing, College of Pharmacy and College of Population Health remain canceled Tuesday. Nonessential HSC employees were asked to remain home Tuesday. Essential and clinical employees reported to their normal duty stations.

Classes at UNM’s Central and branch campuses are not affected. All HSC academic and research programs should resume normal operations on Wednesday.

This incident remains under criminal investigation, limiting any further information at this time.

We asked if the ransom was paid and have not heard back from officials.