Independent newsroom

Tuesday, October 27, 2026

The File

Every claim traces to a primary source. Uncertainty is labeled. Corrections are public.

Safety · Tuesday, October 27, 2026

A cyberattack sent ambulances away from New Mexico's university hospitals

The File desk · Oct. 27, 2026, 7:31 a.m. ET

Confirmed2 primary sourcesAdded 7:31 a.m. ET, Oct. 27

Status

Confirmed. The ambulance diversion, cancelled appointments, the two-hour limit on new patients, the law enforcement notice and Tuesday's reopening are from the University of New Mexico Health Sciences Center's own updates. The account of a threatening message on workers' computers is Unverified: it was reported by the student newspaper The Daily Lobo, and the university has not confirmed it.
  • Confirmed
    On Monday, Oct. 26, a "cybersecurity event" hit the University of New Mexico Health Sciences Center in Albuquerque. All ambulance traffic was diverted to other hospitals, and all clinic appointments that day were cancelled (UNM HSC, 4:30 p.m. ET update).
  • Confirmed
    From 2:30 to 4:30 p.m. ET, UNM Health limited new patients; outpatient surgeries and appointments were suspended for the rest of the day. The university notified state and federal law enforcement and opened an emergency operations center (UNM HSC, 8:08 p.m. ET update).
  • Confirmed
    As of 12:27 a.m. ET Tuesday, UNM Hospital and Sandoval Regional Medical Center are open and all clinics resume regular appointments and procedures Tuesday; Health Sciences classes are cancelled Tuesday (UNM HSC).
  • Unverified
    A recorded message played on hospital workers' computers claimed the attackers had stolen student and employee data, including Social Security numbers, and demanded contact. UNM has not confirmed the message or the claim (The Daily Lobo, citing audio first shared by KOB 4 and a UNM Hospital physician).
On Monday afternoon, ambulances heading for the University of New Mexico's hospitals in Albuquerque were sent to other hospitals instead, after what the university called a "cybersecurity event" spread across its health system. By late Monday night the hospitals were open again, and the university said clinics would see patients on Tuesday.1
Security teams moved immediately to contain the attack, the university's health system said, notified state and federal law enforcement and brought in outside help to investigate. For two hours, from 2:30 to 4:30 p.m. ET, it limited the new patients it would take, and it thanked hospitals in Albuquerque and Santa Fe for taking patients in the meantime. Clinic appointments were cancelled for the day, outpatient surgeries and appointments were suspended for the rest of the day, and students and nonessential staff were sent home.1
At 4:30 p.m. ET, the university began bringing systems back online in phases. Its latest update, at 12:27 a.m. ET Tuesday, says UNM Hospital and Sandoval Regional Medical Center are open and all clinics resume regular appointments Tuesday. Classes at the schools of medicine, nursing, pharmacy and population health are cancelled Tuesday.1
The university has not said what kind of attack it was, or whether any patient, student or employee information was taken. It says it is limited in what it can share because this is an active law enforcement investigation.1
The Daily Lobo, the student newspaper, reported that a recorded message played on workers' computers claimed the attackers had student and employee data, including Social Security numbers, and demanded that administrators contact them. The university has not confirmed the message or the claim.2
Why it matters (Estimate). Estimate. When a hospital's computers go down, care slows: records, scans, lab results and medication orders all live on the network. Sending ambulances elsewhere protects patients but adds minutes on the road, which matters most for heart attacks, strokes and trauma. Attacks on hospitals have become a regular way to extort money, and the open question here is whether personal data was stolen, which can harm people long after the systems come back. This is our reading.
Shortly after noon Monday, Mountain time, administrators told health workers to turn off and unplug their desktop computers, switch off Wi-Fi on their phones and keep working on paper forms, according to a copy of the message a physician gave The Daily Lobo.2
How we know

Notes

  1. 1.University of New Mexico Health Sciences Center, "Update on Cybersecurity Event at UNM Health Sciences Center," updates at 2:30 p.m., 6:08 p.m. and 10:27 p.m. Mountain time Oct. 26 (4:30 p.m., 8:08 p.m. and 12:27 a.m. ET). Times converted to ET. Source 1.
  2. 2.The Daily Lobo, Oct. 26, citing audio first shared by KOB 4 and a UNM Hospital physician. Not an official page; Unverified. This desk found no alert from the U.S. Cybersecurity and Infrastructure Security Agency about the incident. Source 2.

What is still unknown or disputed

  • Who carried out the attack, and how.
  • Whether patient records or other personal data were taken.
  • Whether all of the health system's computer systems are fully back.

Primary sources

Every claim in this story is drawn from the documents below. If a fetch failed, that is recorded on the card.

  1. Source 1

    Update on Cybersecurity Event at UNM Health Sciences Center

    University of New Mexico Health Sciences Center · October 26, 2026

    Currently, all ambulance traffic is being diverted to other hospitals and all appointments at all clinics today have been cancelled.

    https://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hsc

  2. Source 2

    Cyberattack forces closure of UNM HSC and suspension of classes, research through Tuesday

    The Daily Lobo · October 26, 2026

    The authenticity of the recording or its claims have not yet been confirmed by UNM officials

    https://www.dailylobo.com/article/2026/10/cyberattack-forces-closure-of-unm-hsc-and-suspension-of-classes-research-through-tuesday