The UNM Health Sciences Center has restored its critical electronic systems following a cybersecurity event on Monday, October 26, 2026, that forced New Mexico’s only Level I trauma center to briefly divert emergency traffic and cancel outpatient surgeries across dozens of clinics.
Clinical operations, including regularly scheduled appointments and procedures, resumed on Tuesday afternoon. The health system maintains that the disruption was limited to end-user devices.
Timeline of Disruption
The cybersecurity event was first detected at approximately 11:00 AM MDT on October 26. The impact on hospital workflows was immediate, leading to a two-hour diversion of ambulance traffic between 12:30 PM and 2:30 PM MDT while staff moved to manual downtime procedures. During this window, emergency patients were rerouted to other regional health systems.
The disruption extended beyond the emergency department, as outpatient surgeries and appointments were suspended for the remainder of Monday across more than 30 clinics. Academic programs at the UNM Health Sciences Center, including the School of Medicine, College of Nursing, and College of Pharmacy, also suspended classes through Tuesday, October 27, with a scheduled resumption on Wednesday, October 28.
Scope of the Event
According to statements from UNM, the event primarily affected “end-user devices”—such as individual workstations—and did not penetrate core servers or the central electronic health record systems.
Restoration and Next Steps
As of Wednesday, the focus at UNM Health has shifted from technical recovery to clearing the backlog of patient care delayed by the outage. Hospital officials have not yet confirmed whether any specific patient or employee data was successfully exfiltrated, noting only that their internal assessment regarding core system integrity is ongoing.
Patients whose appointments were canceled on Monday are being contacted for rescheduling. While internal systems are back online, the health system remains in a period of heightened monitoring to ensure no residual malware exists on the end-user devices that were initially targeted.
