The University of New Mexico Health System diverted all ambulances to other hospitals and canceled appointments at more than 30 clinics Monday because of a cybersecurity incident, leaving the state for a time without an emergency department able to treat the most serious injuries, The Associated Press reported. UNM runs New Mexico's only Level 1 trauma center, the highest tier of trauma care, so a single IT event reduced emergency capacity for an entire state and forced other health systems to absorb its patients.
What Happened
In a 2:30 p.m. update on its Health Sciences Center news site, UNM Health said all ambulance traffic was being diverted and all clinic appointments that day were canceled. It told patients not to come to its facilities, to call 911 in an emergency and to put off nonemergency care. The issue affected the whole Health Sciences Center, which canceled classes at its medicine, nursing, pharmacy and population health colleges and sent nonessential staff home.
UNM later said its IT security teams had moved to contain the event and notified state and federal law enforcement. It said it limited acceptance of new patients from 12:30 to 2:30 p.m., with health systems in Albuquerque and Santa Fe helping patients get care elsewhere, and began restoring systems in phases at 2:30 p.m.
In an update Monday night, UNM said UNM Hospital and Sandoval Regional Medical Center were open and that clinics would resume regular appointments and procedures Tuesday. Security teams were still working to resolve the event, Health Sciences classes remained canceled Tuesday, and nonessential Health Sciences employees were asked to stay home.
Several UNM employees told the AP that late Monday morning, messages appeared on their computers claiming that attackers had stolen student, employee and patient data. That claim has not been verified. An extortion group called BYOD later claimed the attack on its leak site, Help Net Security reported Tuesday; its claims, which include tens of thousands of machines and student and employee records, are unconfirmed. UNM has not said whether any data was accessed or taken. A health system spokesperson declined to comment, citing an active law enforcement investigation, and UNM's own update said that investigation limits what it can share. FBI spokesperson Margot Cravens in Albuquerque told the AP the bureau was assisting. Presbyterian Healthcare Services and Lovelace Health System, two other major New Mexico providers, said they were coordinating with UNM, including by taking additional patients.
Why It Matters
The scale shows the stakes. UNM's website says the system handles about 900,000 outpatient visits and 100,000 emergency room visits a year, according to the AP. When the only Level 1 trauma center in a state stops accepting ambulances, the most severely injured patients lose their highest level of in-state care until it returns.
For hospital boards and executives, the episode shows that IT systems are part of clinical capacity: one event halted ambulance intake, outpatient surgery, clinics and teaching on the same afternoon. For state health officials and emergency planners, it shows that regional surge capacity depends on neighboring systems being able to take diverted patients on short notice, as Presbyterian and Lovelace did Monday. Leaders elsewhere can test how long their own organizations could run on manual downtime procedures and which partners would absorb their patients.
The displayed messages also stand out. Josephine Wolff, a Tufts University professor of cybersecurity policy, told the AP that attacks on hospitals, including ransom demands, have occurred for about a decade, but that breaching a system to show a message on computers is "pretty unusual."
Context
Federal policy on hospital cybersecurity is still moving. The Primary Wire reported in October that the Senate passed the Health Care Cybersecurity and Resilience Act by unanimous consent, citing SecurityWeek. The bill would fund grants for hospital cyber defense, with added support for rural facilities, make the Department of Health and Human Services' preparedness office the sector's lead risk agency and feed it threat intelligence from the Cybersecurity and Infrastructure Security Agency. It went to the House.
What to Watch
- Whether UNM's investigation finds that patient, student or employee data was taken, as the on-screen messages claimed.
- Whether BYOD's claims are substantiated or a ransom demand surfaces; UNM and the FBI have so far said little.
- Whether Tuesday's clinic reopening holds, when Health Sciences classes resume and when UNM says systems are fully restored.
