Cyber Attack Freezes ER – Dying Patients Diverted!

Emergency room entrance at a modern hospital — Photo: Rob Hainer / Shutterstock

New Mexico’s only Level I trauma center sent every ambulance somewhere else after a sudden cybersecurity issue disrupted care across the system.

Story Snapshot

UNM Health System diverted all ambulance traffic and told patients to stay away.
More than 30 clinics canceled appointments as teams worked to contain the incident.
Non-essential staff and students were told to leave campus to reduce risk.
An emergency operations center was activated to manage the response.

What UNM Did In The First Critical Hours

University of New Mexico Health officials said they were working to resolve a cybersecurity issue and gave clear safety instructions. Patients were told not to come to any UNM facility. Emergencies were directed to call 911. Non-urgent care was delayed. The system diverted all ambulance traffic to other hospitals to protect emergency care. UNM canceled appointments at all clinics that day, which reporting said affected more than 30 locations. These steps aimed to keep patients safe while systems were impaired.

Leaders also thinned out their campuses to cut risk. Non-essential staff and students in the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health were told to leave. Clinical and other essential teams stayed in place. This is a standard containment move. Fewer people on the network lowers the chance that more devices spread trouble. It also frees space and focus for response teams to work without distraction.

How The Hospital Contained The Threat

Reporters described internal alerts that told workers to shut down desktops and disconnect phones from hospital Wi-Fi. That matches common playbooks for network isolation. Disconnect first, investigate next, restore last. One outlet said UNM Health Sciences Center opened an emergency operations center. That hub helps incident command set priorities, track impacts, and decide when to resume services. These actions show a shift from business-as-usual to safety-first operations when vital systems falter.

Officials did not share the attack vector, the entry point, or whether any data was taken. They focused on patient safety instructions and service status. That is typical in the early window of a hospital cyber event. The facts that matter to the public in the first hours are simple: where to go, what is open, and how to get help. The deeper forensics come later and often take time to confirm.

Why Diversion And Closures May Have Saved Lives

Ambulance diversion and clinic closures look harsh, but they can prevent worse harm. When core systems go down, clinicians lose access to electronic orders, medication records, imaging, and alarms. Mistakes rise in that fog. Sending ambulances to stable facilities keeps strokes and heart attacks on a safer path. Shutting clinics stops a flood of patients from arriving to half-blind systems. The academic record shows that many hospital ransomware and cyber events disrupt care operations, including ambulance diversions.

That pattern is not rare. Peer-reviewed research found that 44 percent of healthcare ransomware incidents caused real care disruption, including canceled appointments and diversions. That aligns with what UNM did. It also explains why their steps, while disruptive, make operational sense. The faster teams isolate networks, the faster they can stand services back up. Care continuity begins with stopping the bleed on the network itself.

What To Watch Next: Restoration And Accountability

The next milestones will be clear and measurable. Ambulances will resume normal routing. Clinics will restart and reschedule backlogs. Phone and portal systems will stabilize. UNM will likely publish more detail once forensics harden and regulators are briefed. The best practice is an incident timeline and a plain-language summary of what failed, how it was fixed, and what will change. That builds trust without giving a roadmap to criminals.

UNM HEALTH SCIENCES CYBERSECURITY UPDATE

Oct. 26, 2026 | 6:08 p.m.

UNM Health began resuming operations and bringing systems back online in phases at 2:30 p.m. Monday.

— UNM Health Sciences (@UNMHSC) October 27, 2026

Expect neighboring hospitals to feel the ripple. Diversions shift emergency volume across a metro area. That pressure needs coordination so one emergency room does not get swamped. Public leaders should demand resilience, not blame the first responders who pulled the fire alarm. The conservative common-sense view is simple: protect patients first, restore systems fast, and spend on defenses before a crisis, not after. Transparent after-action reviews help make that spending smarter.