Hospital Cyberattack in New Mexico: Ambulances Diverted and 36,000 Machines Claimed

A hospital cyberattack rarely looks like a movie. On Monday 26 October at the University of New Mexico Health Sciences Center, it looked like staff unplugging their computers. Then ambulances went elsewhere, more than 30 clinics cancelled appointments, and a state lost its only Level 1 trauma centre for a few hours.

What happened in this hospital cyberattack

According to The Register, administrators detected the breach at about 11:30 in the morning. Roughly 40 minutes later, staff were told to shut down and unplug their machines and switch off Wi-Fi on mobile devices. At 14:30 local time the university announced a “cybersecurity event”.

The Albuquerque Journal reported that the hospital limited new patient intake between 12:30 and 2:30 p.m. while technicians rebooted the network. Other outlets describe ambulance diversion lasting about two hours, so the exact window varies by source.

The wider damage was bigger than the diversion. All appointments and outpatient surgeries at more than 30 clinics were cancelled for the day. Classes at the medicine, nursing, pharmacy and population health colleges were cancelled for two days. Systems came back in phases from late afternoon.

The Associated Press, in a report carried by WFTV, noted that UNM runs the state’s only Level 1 trauma centre and handles about 100,000 emergency visits a year. For those hours, New Mexico had no emergency department able to treat the most serious injuries.

What the attackers claim

A group calling itself BYOD says it did this. It is a new extortion gang, and little is known about it. Its leak site claims 36,000 compromised machines, both Active Directory forests and two Oracle databases. It also says it holds personal data on every student and employee.

None of that is confirmed. UNM has not said whether ransomware was deployed, and it has said an active law enforcement investigation limits what it can share. Help Net Security reported that the university later said the event affected some end-user devices but did not penetrate core systems or servers. That sits awkwardly beside the group’s claims, and only the investigation will settle it.

One detail stands out. Employees saw a message play on their computers claiming data theft. Josephine Wolff, a Tufts University professor of cybersecurity policy, told the AP that this is “pretty unusual”. It suggests the attackers had enough reach to push content to many machines at once.

Why this hospital cyberattack matters beyond New Mexico

Most UK organisations do not run a trauma centre. But the pattern applies to any business with many staff and many devices.

The timeline is the lesson. Detection came in the late morning, and the shutdown order followed within the hour. That is fast. Yet the disruption still ran for days, because the hard part is not stopping an attack. It is bringing a few thousand machines back safely.

Recovery time is where the money goes, and a hospital cyberattack makes that visible. The Albuquerque Journal cites Comparitech data putting average healthcare downtime after a cyberattack at 17 days. It also notes that the University of Mississippi Medical Center took nine days to return to normal after a similar attack earlier this year. UNM seems to have done better, but it was still a messy week.

What to check in your own network

You do not need to know exactly what BYOD did to learn from the claims. Three questions are worth an afternoon.

• Can one account reach everything? A claim of two compromised Active Directory forests points to a domain-wide problem. Our guide to Active Directory attack paths shows how attackers climb from a single login to full control.
• Is the network split up? If a laptop in one clinic can talk to a database in another building, a single infected device becomes everyone’s problem. An internal network test shows what an attacker can reach after getting a foothold.
• Do you know your manual fallback? UNM could keep treating people because staff had paper processes and nearby hospitals. Write down which systems you could not run without, and what you would do for the first 48 hours.

If you run a health or care provider, our healthcare testing guide covers what a sensible scope looks like. And if an incident does hit, the steps in our post-attack checklist are worth reading before you need them.

The takeaway

After any hospital cyberattack, treat the attacker’s claims with caution and the outage as fact. A hospital system lost access to its own computers for a day, and a whole state felt it. If your own organisation would struggle to answer “what stops working if we unplug everything at 11:30?”, that is a gap you can test for now. Aardwolf Security can scope a penetration test or security review if you want a second pair of eyes; you can get in touch here.