UNM hospitals reopen after cyber incident diverts patients; IT alert remains active

Hospitals open, with clinic appointments scheduled to resume

UNM Hospital and Sandoval Regional Medical Center were open in the university’s latest operational update, issued at 10:27 p.m. local time on October 26. Regular clinic appointments and procedures were scheduled to resume October 27. That is a significant change from the earlier disruption, but the announcement establishes a reopening plan for clinics, not independent confirmation that every scheduled service has resumed. [1]

UNM’s IT alert records the cybersecurity issue as starting at 11:30 a.m. on October 26. That timestamp describes the incident’s recorded status, not a proven initial-compromise time. The later operational account identifies restrictions on accepting new patients between 12:30 and 2:30 p.m., followed by phased restoration. Outpatient appointments and surgeries were suspended for the rest of the day. [1][2][3]

Other restrictions remain in the October 27 instructions. Health-sciences classes are canceled, and nonessential Health Sciences Center employees are told to stay home. Clinical and essential personnel, along with students who have clinical responsibilities, should report. Those distinctions matter for anyone interpreting the hospital reopening as a return to the normal university schedule. [1]

The disruption extended into regional care

The Albuquerque Journal reported canceled appointments and outpatient surgeries across more than 30 clinics. AP independently documented patients being redirected or told to reschedule at hospital entrances, and obtained confirmation that Presbyterian Healthcare Services and Lovelace Health System were accepting additional patients. Together, these accounts establish actual interruptions to care and additional demand on neighboring providers, rather than merely a precautionary computer-system shutdown. [2][5]

UNM operates New Mexico’s only Level I trauma center. Its trauma-service page describes approximately 7,000 critically ill or injured patients treated annually, a large rural catchment and round-the-clock surgical coverage. That annual figure is background service volume, not an incident victim count. The regional significance is an inference from this specialist role and the documented transfers of demand: disruption at UNM can affect access beyond its own scheduled patients. [2][4][5]

Clinical reopening does not settle the IT status

The disclosed technical scope is the Health Sciences Center and its clinical delivery system. UNM IT explicitly says main-campus and branch-campus systems were unaffected, although HSC employees could lose access to some university-wide services. That distinction limits what can responsibly be called a university-wide incident: difficulty accessing a shared service does not, by itself, establish compromise of the systems providing it. [3]

The IT notice remained current on October 27 and continued to warn of disrupted HSC services even after UNM announced that its hospitals were open. The practical inference for clinical and technical teams is to track patient-service availability separately from system restoration. Reopening is an operational milestone, but these notices do not establish complete technical recovery or identify which remaining services are unavailable. [1][3]

UNM activated an Emergency Operations Center, notified state and federal law enforcement, and brought in outside investigative partners. Those are confirmed response measures, not published forensic conclusions. The public notices identify no affected software vendor, product version, vulnerability, initial-access route or malicious infrastructure, so they provide no basis for tying the disruption to a particular exploit or prescribing an incident-specific patch. [1][3]

Data-theft claims remain separate from verified findings

Employees told AP that messages displayed on computers claimed student, employee and patient information had been stolen. Those accounts support reporting that a theft claim appeared, but they do not verify that information left UNM’s systems. The FBI confirmed it was assisting, without supplying technical findings that substantiate the claim. The possible data exposure therefore remains an investigative question, not a confirmed breach population. [5]

UNM’s public account describes a cybersecurity event under investigation. It does not confirm encryption, a ransom demand or an attacker, so labeling this confirmed ransomware would exceed the evidence. The reviewed reporting also supplies no verified number of diverted patients or incident-attributable injuries or deaths. Documented cancellations and redirections establish disruption, but they cannot be converted into a quantified claim of patient harm. [1][2][5]

What the sources independently establish

UNM’s newsroom is the primary source for reopening instructions and the official response; its IT alerts add the continuing service warning and campus boundaries. These are complementary statements from the same institution, not independent corroboration. AP adds distinct evidence through observations at hospital entrances, employee interviews, confirmation from neighboring providers and contact with the FBI. Those contributions strengthen the operational account without resolving the intrusion mechanism. [1][3][5]

The Albuquerque Journal adds local reporting and the clinic scope, although much of its operational chronology comes from UNM’s release. SecurityWeek carries the AP report and should not be counted as a second independent confirmation of AP’s claims. Likewise, early blanket-diversion language and later reopening instructions reflect changing conditions. The later account should govern current guidance rather than suggesting an uninterrupted shutdown through October 27. [1][2][5][6]

Rescheduling, remaining outages and forensic findings come next

For patients, the immediate task is rescheduling missed appointments and procedures and following current UNM instructions. October 26’s blanket stay-away guidance should not be presented as the rule for October 27. The key follow-up is whether clinics actually resume the announced schedule, how quickly canceled visits can be accommodated and whether any procedures remain delayed despite the broader reopening. [1][2]

For defenders and service planners, the evidence supports a recovery-focused response, not speculation about a particular vulnerability. The next useful disclosures are which systems remain unavailable, how long ambulance diversions lasted, how many patients were redirected and whether neighboring providers continue receiving additional demand. Separately, forensic findings must establish whether information was stolen. Operational recovery and the data-theft investigation need distinct updates because neither answers the other. [1][3][5]