Ransomware hits UNM Health, shuts NM's only trauma center

UNM Health Sciences Center announced a cybersecurity incident at 2:30 p.m. local time on Monday, Oct. 26, immediately canceling remaining clinic appointments and classes. BleepingComputer reported that the system diverted ambulance traffic to nearby hospitals, suspended outpatient surgeries, and temporarily limited new admissions while IT security teams worked with outside responders and notified state and federal law enforcement. Help Net Security's independent coverage confirmed a ransomware group calling itself Byod claimed the attack, alleging it compromised both Active Directory forests, two Oracle databases, and personal data for every student and employee — claims UNM has not verified.

UNM Hospital houses New Mexico's only Level I trauma center. By Tuesday, Oct. 27, the hospital and Sandoval Regional Medical Center had reopened and clinics resumed scheduled appointments, but more than 30 UNM Health System clinics statewide had lost a full day of scheduled care, and classes at the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health stayed canceled into a second day.

What stands out operationally is how fast a single incident response forced a full-system shutdown rather than a contained isolation of the affected system. That's typical of hospital IT: patient portals, scheduling, and clinical web apps are frequently built on shared infrastructure with no clean failover path, so a breach anywhere becomes a reason to pull everything offline. Clinics that depend on a patient-facing web app for scheduling, intake, or results delivery are exposed the same way UNM was unless that app is architected — and hosted — separately from the core hospital network it talks to. That's the kind of resilience question a web development team should be answering before an incident, not during one.

Why "isolate and contain" so often becomes "shut down everything"

Hospital systems typically share authentication, databases, and network segments across clinical and administrative functions built over a decade or more by different vendors. When ransomware actors compromise a domain controller, as Byod claims here, the safest response is often a blanket shutdown rather than a targeted one, because security teams can't be certain which systems share the compromised credentials. A patient-facing web app that authenticates against the same Active Directory forest as the EHR inherits that same blast radius, even if the app itself was never touched.

What a smaller clinic can actually do about it

Few clinics can rebuild hospital-grade network segmentation, but a web app that handles scheduling, intake forms, or results delivery can be built with its own isolated authentication and hosting, so a breach in the core network doesn't automatically take the patient-facing layer offline too. That's a scoping decision made at build time, not a patch applied after an incident.