Cyberattack Disrupts UNM Hospital Operations and Medical School Classes

En bref

• A cyber intrusion affected UNM healthcare facilities and the medical school.
• Emergency transports were redirected and instruction was canceled during the response.
• Officials restored systems and warned against engaging with the attackers.

The University of New Mexico faced a cyber intrusion that disrupted operations across its hospital systems and medical school. During the incident, emergency medical transports were redirected away from affected facilities, and some classes were called off as staff worked through the operational fallout. The situation touched both clinical care and academic instruction, showing how interconnected those environments have become.

Healthcare facilities and the medical school community were directly affected. Patients dependent on ambulance arrivals experienced altered routing, while students and faculty saw scheduled teaching interrupted. The disruption did not require a specific software vulnerability to cause operational strain; the impact came from the availability and integrity of systems supporting hospital and campus functions.

Officials have since restored the affected systems. They also advised against making contact with the hackers, a standard caution intended to avoid worsening the situation or complicating response efforts. The severity appears limited relative to large-scale healthcare breaches, but the event still highlights the importance of downtime planning for both patient care and classroom continuity.

For K-12 and government-sector IT teams, the lesson is familiar: critical services can be disrupted even when the technical details remain narrow. Hospitals and schools share dependencies on identity, communications, scheduling, and emergency coordination tools. A disruption in one area can quickly cascade into transport delays, canceled instruction, and public uncertainty.

What to watch now is whether restored services remain stable and whether any follow-on activity appears. Administrators should verify that emergency routing and class notification processes are back to normal, preserve relevant logs, and reinforce guidance that staff should not engage directly with attackers. Clear communication through official channels will be important if further disruptions occur.

À faire maintenant

1. Verify that restored hospital and academic systems are stable, then monitor authentication, endpoint, and network logs for unusual activity.
2. Confirm ambulance diversion and clinical downtime procedures are fully stood down and that emergency coordination channels are functioning.
3. Preserve logs and incident evidence, and coordinate with law enforcement or cyber insurance resources before making major changes.
4. Brief staff and faculty not to contact the attackers and to route any suspicious messages to the incident response team.
5. Reset credentials and enforce multi-factor authentication for accounts where compromise is suspected or confirmed.
6. Test backups and recovery steps for systems supporting patient transport, scheduling, and classroom communications.
7. Send clear updates to students, faculty, and staff through official channels about service status and reporting procedures.

Source originale

The Record