Ransomware disrupts UNM Health Sciences Center, forcing ambulance diversions

Key points

• Ransomware hit UNM's Health Sciences Center this week.
• Ambulances were redirected and surgical procedures were called off.
• Classes were canceled and students were dismissed from campus.
• Fortra is named among vendors tied to the incident.

An extortion-driven cyber intrusion struck UNM's Health Sciences Center during the current week, based on the facts available. The event pushed emergency medical services to reroute ambulances away from the facility, led officials to scrub scheduled operations, and disrupted academic operations. Learners were instructed to leave campus, and classes were called off while the organization responded.

Because the affected site is a university health center, the disruption reaches beyond IT systems: patient transport, surgical schedules, and classroom instruction all intersect there. Redirecting ambulances shifts emergency load to nearby hospitals; calling off operations creates backlog and patient communication burdens; dismissing students interrupts coursework and campus services. The vendor list includes Fortra, a detail that may matter as investigators trace access paths and third-party dependencies.

Why it matters: healthcare and education are high-impact targets, and ransomware can halt clinical workflows and the academic calendar at the same time. The combined clinical and academic effects suggest broad system dependencies. No CVE is tied to the event in the facts, so the initial access vector remains unclear; watch for updates on patient data exposure, restoration timelines, and whether the group publishes stolen data.

This week's event fits a pattern of ransomware crews targeting large public institutions where downtime is costly. For K-12 and government peers in New Brunswick, the lesson is to review third-party risk, offline backups, incident command for clinical and academic continuity, and communication plans. Watch for official statements from UNM and Fortra, restoration milestones, and any data breach notifications.

What to do now

1. Activate the incident response plan, isolate affected network segments, and preserve logs and forensic evidence before rebuilding systems.
2. Verify that offline and immutable backups exist for clinical, academic, and administrative systems, then test restoration procedures.
3. Enforce multi-factor authentication, reset privileged credentials, and review remote access, VPN, and third-party accounts for unauthorized changes.
4. Audit Fortra and other file-transfer or remote-support tools, restrict outbound traffic, and remove unnecessary vendor access paths.
5. Prepare clinical downtime procedures and coordinate ambulance diversion and surgery rescheduling with partner hospitals and emergency services.
6. Notify legal, privacy, and executive teams, then prepare breach-notification and public-status messaging for patients, students, and staff.
7. Run a combined healthcare-education continuity tabletop covering student dismissal, class cancellation, and patient communication.

Original source

Graham Cluley