--- title: "UNM Health Sciences cybersecurity incident" description: "UNM Health Sciences reported a cybersecurity event that disrupted clinical services; critical systems were restored by October 27." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-28" canonical_url: "https://www.ally.security/incidents/unm-health-sciences-cybersecurity-incident-2026" markdown_url: "https://www.ally.security/incidents/unm-health-sciences-cybersecurity-incident-2026.md" stix_url: "https://www.ally.security/incidents/unm-health-sciences-cybersecurity-incident-2026/stix.json" --- # UNM Health Sciences cybersecurity incident The university reported affected end-user devices, with no penetration of core systems or servers in its assessment. Last modified Oct 28, 2026 · 1 source ## Summary - **Environment:** UNM Health Sciences end-user devices and clinical operations - **Operational impact:** Ambulance diversions, canceled care and classes; critical clinical systems restored - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [The University of New Mexico](https://www.unm.edu/) began containing a cybersecurity threat at its Health Sciences Center on October 26, 2026. Its [official update](https://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hsc) says some end-user devices were affected, while core systems and servers were not penetrated in its assessment. [1](#source-1) ## Impact Ambulances were diverted from 12:30 to 2:30 p.m. local time October 26, and outpatient surgeries and appointments were suspended for the rest of that day. By October 27, critical systems, normal ambulance traffic and scheduled clinical care were restored. Four Health Sciences schools still canceled classes that Tuesday; central and branch-campus classes were unaffected. [1](#source-1) ## Timeline ### October 26, 2026 — Containment and clinical disruption Containment began around 11 a.m.; phased restoration started at 2:30 p.m. [1](#source-1) ### October 27, 2026 — Critical clinical systems restored The university reported restored clinical operations, with academic disruption continuing. [1](#source-1) ### October 28, 2026 — Briefing updated This briefing was last reviewed and updated on October 28, 2026. ## Threat Group & Attack Vector The official notice does not establish ransomware, data theft, an entry vector or an affected-person count. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed authoritative evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response UNM activated its Emergency Operations Center, engaged external partners and notified law enforcement. Rescheduling care and the criminal investigation continued. Academic and research operations were expected to resume October 28; the reviewed notice does not confirm that happened. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Update on Cybersecurity Event at UNM Health Sciences Center official · University of New Mexico · Oct 26, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** UNM Health Sciences cybersecurity incident: UNM diverted ambulance traffic between 12:30 and 2:30 p.m. on October 26 and suspended outpatient surgeries and appointments for the rest of that day. Phased restoration began at 2:30 p.m. 2. **Resulted In · 100% confidence · current** UNM Health Sciences cybersecurity incident: UNM Health Sciences began containment around 11 a.m. local time on October 26 after identifying a cybersecurity threat. Its subsequent assessment said some end-user devices were affected, but core systems and servers were not penetrated. 3. **Resulted In · 100% confidence · current** UNM Health Sciences cybersecurity incident: Four Health Sciences schools canceled classes October 27 and nonessential employees were asked to stay home. Central and branch-campus classes were unaffected; normal HSC academic and research operations were expected October 28, not yet confirmed. 4. **Occurred At · 100% confidence · current** Threat containment and clinical disruption: 2026-10-26 5. **Resulted In · 100% confidence · current** UNM Health Sciences cybersecurity incident: By the October 27 2:02 p.m. update, critical electronic systems were online, hospitals fully open, ambulance traffic normal and clinics operating scheduled appointments and procedures. 6. **Resulted In · 100% confidence · current** UNM Health Sciences cybersecurity incident: Critical clinical systems reported restored 7. **Resulted In · 100% confidence · current** UNM Health Sciences cybersecurity incident: Threat containment and clinical disruption 8. **Resulted In · 100% confidence · current** UNM Health Sciences cybersecurity incident: UNM activated its Emergency Operations Center, worked with external partners to secure the network, notified state and federal law enforcement and planned to reschedule disrupted care. The criminal investigation continued. 9. **Occurred At · 100% confidence · current** Critical clinical systems reported restored: 2026-10-27 10. **Affected Organization · 100% confidence · current** UNM Health Sciences cybersecurity incident: University of New Mexico 11. **Occurred At · 100% confidence · current** UNM Health Sciences cybersecurity incident: 2026-10-26 12. **Disclosed At · 100% confidence · current** UNM Health Sciences cybersecurity incident: 2026-10-26