University of New Mexico Hospital Diverts Ambulances After Cyberattack

What happened

On Monday the University of New Mexico Health System detected a cyberattack that forced the IT team to isolate affected workstations, disconnect Wi‑Fi, and notify federal law‑enforcement. Ambulances were rerouted for two hours and outpatient surgeries were suspended. The university’s academic and research units also closed. A ransomware group called BYOD later claimed responsibility, saying it compromised 36,000 machines and exfiltrated data on patients, students and employees. UNM began restoring systems later that day and expects full clinical operations to resume the next day, while the investigation remains active.

Why it matters for trust and compliance

• The incident underscores the importance of documented, exercised incident‑response and business‑continuity controls that can be presented as audit evidence.
• Map incident‑response procedures to a control objective for audit evidence.
• Leverage continuous monitoring data to demonstrate timely detection and containment.

Who is affected

Recommended actions

1. Update and test your incident‑response playbook for rapid isolation of clinical systems.
2. Collect logs and endpoint snapshots now to build defensible evidence for future audits.