UNM Health Disclosed Ransomware Attack Disrupting Patient Care and Surgeries

What Happened

The University of New Mexico Health Sciences Center disclosed a cyberattack, reported by BleepingComputer as a ransomware incident, that caused system outages and disrupted patient care and academic activities. Reported impacts include disruptions to surgeries. Details on the initial access vector, the ransomware group or variant involved, and the scope of any data exfiltration have not been disclosed.

Why It Matters for Defenders

Healthcare organizations remain a high-value target for ransomware operators. They hold sensitive patient data, run legacy and interconnected clinical systems, and face operational urgency when care delivery is disrupted. An incident severe enough to affect surgical scheduling shows that ransomware in healthcare is not just a data-confidentiality issue but a patient-safety concern. Academic medical centers like UNM Health add complexity, since research, teaching, and clinical networks are often intertwined. That can widen the impact of a single compromise.

What Defenders Should Watch For

• Review segmentation between clinical/EHR systems, academic/research networks, and general IT infrastructure. Flat or poorly segmented networks let attackers pivot from an initial foothold into critical care systems.
• Ensure downtime procedures (manual charting, paper-based scheduling, backup communication channels) are tested and current. Outages can force clinical staff back to manual processes with little notice.
• Audit backup integrity and isolation (offline/immutable backups) for EHR, scheduling, and imaging systems, as these are common ransomware targets in hospitals.
• Monitor for common ransomware precursors such as unusual lateral movement, mass file encryption, disabling of endpoint protection or backup agents, and anomalous use of remote access tools or admin credentials.
• Confirm incident response and business continuity plans address scenarios where elective procedures or surgeries must be postponed.

Developing Story

This is a developing incident. At the time of this write-up, no root cause, threat actor attribution, or ransomware family has been confirmed in public reporting. Defenders in healthcare and adjacent sectors should continue to monitor for updates. Full details are available from the original source: BleepingComputer.