A cyberattack disrupted the University of New Mexico Health System on Monday, October 26, forcing ambulance diversions for about two hours and suspending outpatient surgeries and appointments for the rest of the day. The disruption extended across the University of New Mexico Health Sciences Center, including its academic and research operations, according to statements reported by The Record.
The health system began restoring systems and resuming operations late Monday afternoon. In an update that evening, a spokesperson said appointments would proceed as scheduled on Tuesday, October 27, and patients whose appointments or procedures were canceled Monday would be rescheduled.
The planned clinical restart did not extend to teaching and research. Tuesday classes were canceled at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health, including online and remote classes. UNM Health Sciences academic and research units were also to remain closed Tuesday, with nonessential Health Sciences Center employees asked to stay home.
During Monday’s disruption, ambulances were redirected to health systems in Albuquerque and Santa Fe. The affected health system operates New Mexico’s only burn unit, children’s hospital and Level 1 trauma center, and serves a large share of the state’s uninsured population.
The organization said its IT team took steps to contain the attack and notified federal law enforcement. Local news reports cited by The Record said employees received phone alerts instructing them to shut down and unplug desktop computers and disconnect mobile devices from hospital Wi-Fi.
A ransomware group calling itself BYOD claimed responsibility Monday evening, according to The Record. The group alleged that it had compromised 36,000 machines across the university’s main campus and hospital and stolen information about students, patients and employees. Those are the attackers’ claims; they do not establish a verified count of compromised machines or affected people, or confirm data theft.
The spokesperson did not respond to The Record’s questions about whether ransomware was involved. In its late-Monday statement, the organization said an active law enforcement investigation limited what it could disclose.
