Ransomware Incident Hits UNM's Health Sciences Center, Disrupting Care and Academics

Key points

• Ransomware activity led UNM's Health Sciences Center to disclose a cyberattack.
• Outages have affected clinical care, including surgical services.
• Academic operations were also disrupted.
• The organization has not released affected system or record counts.
• No CVE is associated in the provided facts.

UNM's Health Sciences Center has disclosed a cyberattack attributed to ransomware actors, triggering outages that have rippled across clinical and academic operations. The organization confirmed the incident and resulting service interruptions, but it has not published a count of impacted systems, patients, or records.

On the care side, the disruption has affected patient services and surgical schedules. When clinical systems go offline, staff often must fall back to manual processes, which can slow admissions, delay procedures, and strain communication between departments. The facts available do not specify which platforms failed or how long recovery will take.

Academic activity has also been affected, adding a second front for responders. Healthcare-adjacent academic centers have to restore research, teaching, and administrative tools while protecting clinical availability, which raises the stakes for prioritization and backup validation.

Why it matters: ransomware against health and academic institutions is not just an IT outage; it can delay time-sensitive care and create safety risks. The absence of a public scale estimate means outside observers cannot yet gauge exposure, but the combination of surgery disruption and system outages supports a high-severity assessment.

What to watch: whether the center issues updates on restoration timelines, whether care is diverted or rescheduled at greater scale, and whether regulators or law enforcement confirm additional details. Organizations in similar environments should treat this as a reminder to test downtime procedures and isolate backup and identity systems.

What to do now

1. Activate the incident response plan, isolate affected network segments, and preserve logs and forensic evidence.
2. Validate immutable or offline backups and test restoration for clinical and academic systems in priority order.
3. Enforce MFA on VPN, remote access, and privileged accounts; rotate credentials for administrative and service accounts.
4. Apply emergency patching and ensure EDR coverage while hunting for lateral movement, persistence, and ransomware staging.
5. Move clinical teams to downtime protocols and verify manual workflows, communication trees, and patient triage procedures.
6. Notify legal, privacy, and regulatory stakeholders and coordinate with law enforcement and relevant cyber authorities.
7. Segment clinical networks from academic and administrative environments; restrict SMB, RDP, and unnecessary firewall paths.

Original source

BleepingComputer