Extortion crew claims cyberattack on UNM academic hospitals, disrupting care

En bref

• Extortion group claims cyberattack against UNM hospital network
• Emergency transport rerouted and scheduled visits canceled amid disruption
• Academic medical center operations affected on October 27, 2026
• Patient data exposure is unconfirmed but plausible
• Watch for breach confirmation and clinical system restoration timeline

On October 27, 2026, an extortion outfit asserted that it carried out a cyber intrusion against the hospital system tied to the University of New Mexico, an academic medical center. The claim accompanied operational fallout: emergency transport was rerouted away from affected facilities, and scheduled visits were called off as staff worked around degraded systems.

Patients and clinicians in the UNM network felt the immediate effects. Rerouting emergency cases pushes them toward other facilities, which can lengthen response times and strain nearby hospitals. Cancelled appointments interrupt continuity of care, particularly for people managing chronic conditions or awaiting time-sensitive follow-up.

Beyond availability, the episode raises confidentiality concerns. The extortion crew's claim does not by itself prove that records were taken, but healthcare threat actors frequently pair disruption with data theft and leverage. A breach has not been confirmed in the facts available; treat exposure as unconfirmed but plausible.

Academic medical centers combine patient care, research, and teaching, so downtime can ripple across clinical, educational, and research missions. Extortion groups target hospitals because care cannot pause and public pressure is high. This incident fits a broader pattern of extortion-driven attacks on health systems, where attackers seek both operational paralysis and payment.

For K-12 and government peers, the event is a reminder that shared service dependencies—identity, scheduling, imaging, and communications—are attractive targets. Watch for confirmation of whether patient data was accessed, the restoration timeline for clinical systems, and whether emergency transport rerouting expands. Organizations should verify backup integrity and rehearse downtime procedures now.

À faire maintenant

1. Activate incident response and clinical downtime procedures immediately; coordinate with emergency management on transport rerouting and patient communication.
2. Isolate affected network segments, preserve logs and forensic evidence, and validate backups before any restoration attempt.
3. Reset credentials for privileged and remote-access accounts, enforce MFA, and review authentication logs for unusual activity.
4. Hunt for extortion-actor behaviors such as data staging, outbound transfers, and ransomware precursors; monitor egress closely.
5. Engage privacy and legal counsel to assess potential patient data exposure; avoid confirming a breach until validated.
6. Use verified channels to brief staff and patients, and warn users about phishing or social engineering tied to the incident.
7. Review third-party and remote-monitoring access paths, and tighten controls around shared service dependencies.

Source originale

Help Net Security