New Mexico Hospital System Diverts Patients Amid Cybersecurity Incident
The University of New Mexico Health System experienced a cybersecurity incident that forced its main hospital to divert patients and cancel appointments across more than 30 clinics.
The University of New Mexico Health System (UNM Health) grappled with a significant cybersecurity incident on Monday, forcing its flagship hospital in Albuquerque to divert ambulances and cancel numerous patient appointments. The disruption extended to over 30 affiliated clinics, severely impacting healthcare services across the state. UNM Health operates New Mexico's sole Level 1 trauma center, making the incident particularly critical for emergency care.
In response to the ongoing issue, UNM Health advised individuals not to present at its main hospital and canceled appointments at its extensive network of clinics. While the exact nature and scope of the incident remained unclear, the health system stated it was actively working towards a resolution. The disruption affected a large patient base, with UNM Health's website indicating approximately 900,000 outpatient visits and 100,000 emergency room visits annually.
Other major healthcare providers in New Mexico, including Presbyterian Healthcare Services and Lovelace Health System, confirmed they were coordinating with UNM Health to accept additional patients and mitigate the impact of the diversions. By later in the day, UNM Health began a phased resumption of operations across its hospitals and clinics, signaling progress in addressing the cybersecurity challenge.
Multiple employees within UNM Health reported receiving messages on their work computers that claimed to have accessed and stolen sensitive data, including student and employee information, as well as patient records. A spokesperson for the health system declined to comment on the specifics, citing an active law enforcement investigation. The FBI confirmed its involvement, stating it was "assisting our partner" without providing further details.
The incident underscores the growing vulnerability of critical infrastructure, such as healthcare systems, to cyberattacks. Experts note that such attacks on hospitals, often involving ransomware demands, have been a persistent threat for years. The specific tactic of displaying messages on computers, as reported by some UNM Health employees, is considered unusual, highlighting the evolving and often unpredictable nature of cyber threats.
On the ground, the impact was palpable. At the main Albuquerque hospital entrance, staff members informed arriving patients about potential appointment cancellations. Similarly, at a medical center in the suburb of Rio Rancho, security guards redirected patients, advising them to reschedule. The UNM Health Sciences Center also canceled classes for the day, reflecting the widespread operational impact.
The incident serves as a stark reminder of the ongoing challenges in defending essential services against sophisticated cyber threats. The reliance on digital systems for everything from banking to healthcare makes robust cybersecurity measures paramount. The UNM Health incident, with its direct impact on patient care and the potential exposure of sensitive data, emphasizes the critical need for continuous investment and improvement in cybersecurity defenses within the healthcare sector.
While the investigation is ongoing and details remain limited, the disruption caused by this cybersecurity incident highlights the significant risks faced by healthcare organizations. The coordinated response from other providers and the phased return to normal operations indicate a concerted effort to manage the crisis, but the event serves as a critical case study in the ongoing battle against cyber threats targeting vital public services.