New Mexico Hospital Diverts Ambulances in Cyber Incident

The University of New Mexico Health System took its emergency department offline for ambulance intake Monday after a cybersecurity incident disrupted operations at the state’s largest academic medical center.

UNMHS operates the only Level 1 trauma center in New Mexico and handles approximately 900,000 outpatient and 100,000 emergency room visits each year. When the ED went on diversion, that patient load transferred to Presbyterian Healthcare Services and Lovelace Health System, the two other major systems serving Albuquerque. Both coordinated to accept additional patients.

The disruption ran wider than the main hospital. More than 30 clinics canceled appointments. Classes at UNM’s Health Sciences Center were called off. Multiple employees reported seeing messages claiming attackers had stolen student and employee records alongside patient data, according to SecurityWeek.

No attack type has been officially confirmed. A health system spokesperson declined to comment, citing an active law enforcement investigation. The FBI confirmed it is “assisting our partner” but provided no additional details.

UNMHS said phased operations were resuming later Monday. The scope of any data exfiltration remains unknown pending investigation.

An ED diversion is not a precautionary step. It happens when internal networks are degraded enough to affect patient routing and clinical communication. That threshold is high: hospital IT teams tolerate a great deal of degradation before pulling ambulance traffic from a trauma center. The fact that 30 outpatient clinics closed simultaneously suggests the disruption reached scheduling and records systems, not just a single administrative segment.

Patient data breaches in healthcare have continued at pace through 2026. Healthcare organizations running flat networks between clinical and administrative segments remain exposed to the same lateral movement pattern seen in operational-disruption attacks on critical infrastructure globally.

For health systems reviewing posture now: confirm endpoint protection coverage extends to clinical workstations and nursing stations, not just corporate endpoints. Those are the machines that go offline when a ransomware payload starts encrypting network shares.