Hour by Hour: How a Cyberattack Sent Ambulances Away From New Mexico’s Only Level 1 Trauma Center
A cybersecurity incident at the University of New Mexico Health System diverted ambulances, canceled appointments at more than 30 clinics and closed Health Sciences classes. Employees say messages played on their computers claiming data had been stolen. Here is how Monday unfolded.
On Monday, October 26, New Mexico briefly had no emergency department able to treat the most serious injuries. A cybersecurity incident at the University of New Mexico (UNM) Health System, which runs the state’s only Level 1 trauma center, forced it to send ambulances elsewhere and cancel appointments across its clinics.
This timeline draws on the Associated Press report published by SecurityWeek and UNM Health Sciences Center’s own updates.
Monday, October 26
- Late morning: Several UNM Health employees told the AP they heard messages play across their computers claiming that student, employee and patient data had been stolen. UNM’s IT alerts page lists the issue as starting at 11:30 a.m.
- Around midday: UNM Health limited its acceptance of new patients from 12:30 to 2:30 p.m. as teams responded. IT security teams moved to contain the event, notified state and federal law enforcement and brought in outside help, and leadership opened an emergency operations center.
- 2:30 p.m. update: UNM said all ambulance traffic was being diverted, all clinic appointments for the day were canceled and patients should not come to UNM Health facilities. Nonessential staff and Health Sciences students were sent off campus.
- From 2:30 p.m.: UNM Health began bringing systems back online in phases, as it judged safe. Presbyterian Healthcare Services and Lovelace Health System said they were coordinating with UNM and taking additional patients.
- 6:08 p.m.: UNM said outages had forced it to suspend outpatient surgeries and appointments for the rest of the day and that missed appointments would be rescheduled.
- 10:27 p.m.: UNM said its hospitals, UNM Hospital and Sandoval Regional Medical Center, were open and that clinics would resume regularly scheduled appointments and procedures on Tuesday.
Tuesday, October 27
Per UNM’s late Monday update, Health Sciences classes at the School of Medicine and the Colleges of Nursing, Pharmacy and Population Health are canceled Tuesday, and academic and research units remain closed. Nonessential Health Sciences employees were asked to stay home, while clinical and essential staff report as usual. UNM’s main and branch campuses are not affected.
What is known and what is not
- Scale of the system: UNM Health handles about 900,000 outpatient visits and 100,000 emergency room visits a year, according to its website, and runs more than 30 clinics.
- Law enforcement: The FBI in Albuquerque said it was assisting but declined further comment. UNM says the active investigation limits what it can share.
- Data theft: Claimed in the messages employees heard, but not confirmed by UNM.
- Nature of the attack: Not confirmed. The extent and nature of the issue were not immediately clear, according to the AP.
Tufts University cybersecurity policy professor Josephine Wolff told the AP that attacks on hospitals, including ransom demands, have gone on for a decade, but breaking into a system to play a message on its computers is pretty unusual.
What this means for your company
You do not need to run a trauma center to learn from UNM’s day. The organizations that recover fastest have already decided who makes the call to disconnect, how staff keep working on paper or backup systems, who notifies law enforcement and outside responders, and how customers will be told what is happening. Write that plan down, keep a printed copy, and practice it at least once a year. Pair it with tested, offline backups and network segmentation so one compromised area does not take everything else down with it.
Need help building and testing an incident response plan before you need it? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
