The University of New Mexico Health System diverted all ambulances to other hospitals and cancelled appointments at more than 30 clinics on Monday 26 October 2026 after disclosing a cybersecurity issue, telling patients not to show up at its facilities that day. New Mexico’s only Level 1 trauma centre was among the facilities affected, leaving the state without an emergency department capable of treating the most serious injuries during the diversion. Hospitals and clinics began resuming in phases later in the day, but the cause, data exposure and full restoration are still undisclosed.
What should you do if your UNM Health appointment was cancelled?
Do not go to a UNM Health facility. If you have a medical emergency, call 911. If your need is not an emergency, delay care until UNM Health says otherwise, and wait for word on rescheduling rather than showing up to rebook in person.
- Call 911 immediately if you have a medical emergency, rather than travelling to UNM Hospital.
- Delay non-emergency care until UNM Health says otherwise, and do not show up to rebook in person.
- Watch for UNM Health’s restoration updates before returning, since full service has not been confirmed restored.
What actually happened
UNM Health disclosed the cybersecurity issue on Monday 26 October and said it was working to resolve it, though the extent and nature of the issue were not immediately clear. All ambulance traffic was diverted to other hospitals, and appointments at its more than 30 clinics were cancelled for the day. The system told patients they should not show up to UNM Health facilities on 26 October, and patients with emergencies were directed to call 911 while patients with non-emergency needs were told to delay care until further notice. The system said its hospitals and clinics began resuming operations in phases later in the day. Presbyterian Healthcare Services and Lovelace Health System, two other major healthcare providers in New Mexico, said they were coordinating with UNM Health, including taking additional patients.
The disruption went beyond the main hospital in Albuquerque. It extended to clinics across the network, including Sandoval Regional Medical Center. The system includes UNM Hospital, UNM Children’s Hospital, UNM Sandoval Regional Medical Center in Rio Rancho, and UNM Comprehensive Cancer Center. The Health Sciences Center cancelled classes Monday and Tuesday and was closed for the day, with hospital and medical group employees expected back at work Tuesday. Non-essential personnel and students in the School of Medicine, College of Pharmacy, College of Nursing and College of Population Health were instructed to leave campus while clinical and essential employees remained on duty, and the Health Sciences Center activated an emergency operations center to assess the scope and prevent further impacts.
What UNM has not said
Three things that matter most to patients remain unanswered. The system did not say what caused the issue. It did not say whether patient data was affected or whether the incident involved ransomware. And while resumption began in phases later on Monday, its release did not say when full service will be restored. Until UNM answers those questions, this story is a confirmed service disruption with an unknown cause, not a confirmed data breach and not a confirmed ransomware attack.
The claim that is not confirmed
One ransomware-group claim is circulating, and it must not be treated as fact. A listing indexed by ransomware.live on 26 October at 20:52 UTC attributes the incident to a group calling itself Byod and alleges compromise of 36,000 machines, both Active Directory forests covering the main campus and the hospital sector, every student and employee’s personal information including Social Security numbers, research information, the entire Entra tenant, Oracle HR, payroll and Banner student records, internal emails and Cerner electronic health record rosters. Ransomware.live itself flags Byod as an emerging group and says the claim should be treated with caution until independently verified. UNM has not corroborated the claim and has not named Byod, and no second source reviewed confirms any element of it.
Why one hospital’s diversion is a statewide problem
The following analysis is TechReview’s own, drawn from the confirmed facts above. UNM operates New Mexico’s only Level 1 trauma center, its only academic medical center, and the state’s largest teaching hospital. When its ambulances are all diverted, the state temporarily loses its highest-acuity emergency department, which turns a single hospital’s bad day into a statewide care gap during the diversion. The scale of daily care flowing through the system underlines the point: the network conducts about 900,000 outpatient visits and receives 100,000 emergency room visits each year, which works out at roughly 2,740 visits on an average day. That figure is the scale of daily care, not the number of people affected on 26 October, which remains undisclosed and must not be guessed from it. Becker’s separately reports more than 1 million patient visits each year, consistent with the AP totals.
What to watch next
The first thing to watch for is full restoration and whether rescheduling happens automatically. The second is whether UNM confirms or denies ransomware involvement, data access, or the Byod claim. The third is any patient-notification or breach-disclosure filing if data access is later confirmed. Any of those three would change this story materially, and until one arrives, the honest summary stays where it is: a major hospital system diverted ambulances and closed clinics for a day over a cybersecurity issue it has not yet explained.
Sources
- Associated Press: Cybersecurity issue forces New Mexico hospital to divert patients and close clinics (26 October 2026, by Christopher Keller and Wufei Yu; read via the Bitcomme republication, which carries the full AP copy)
- Associated Press: A cybersecurity issue forces a major New Mexico hospital to divert patients and close clinics (26 October 2026, via the Reflector republication, which carries the full AP copy including the phased-resumption update)
- Becker’s Hospital Review: UNM Health diverts ambulances, cancels appointments in cyber incident (26 October 2026)
- ABQ News: UNM Health diverts ambulances, cancels all clinic appointments Monday over cybersecurity issue (26 October 2026, 1:05 pm local)
- KKOB News Radio: Cybersecurity incident disrupts UNM Health operations, ambulances diverted (26 October 2026)
The Byod ransomware-group claim is reported only as a claim. The ransomware.live listing (discovered 26 October 2026 at 20:52 UTC, carrying the emerging-group caution) was read directly, and a DysruptionHub summary of it was also checked. The claim is not a confirmed fact and is not a source for any confirmed statement above.
Hero image: ambulances at the St. John Hospital emergency entrance in Detroit, photographed by DUBYA18 and shared under a CC BY-SA 4.0 licence via Wikimedia Commons.
