Zero Radar
← feed
CriticalSecurity incidentupdated 29 Oct 2026, 20:21 UTC

University of New Mexico Health hit by ransomware, care disrupted

A cyberattack locked up computer systems at a major hospital network, so ambulances were diverted and many appointments were cancelled. A criminal group has claimed responsibility.

Attacks reported (BleepingComputer, DataBreaches.net)2 independent sources
SeverityCriticalSecurity incident
Being exploited?ReportedBy BleepingComputer, DataBreaches.net, not officially confirmed yet
What to doCheck exposureCheck official UNM Health channels before traveling to any appointment and do not trust unsolicited messages about the outage.
How sure is this?2 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Ransomware groupGroup claims responsibility for attack
  2. 2Systems breachedAttack causes system outages
  3. 3Services disruptedClinics closed, ambulances diverted
  4. 4Care impactedAppointments and surgeries cancelled
  5. ResultHealth system operations halted

What happened

The University of New Mexico Health Sciences Center disclosed a cyberattack causing system outages across its health system, including its Level I trauma center and more than 30 clinics; a ransomware group has claimed responsibility.

Why it is dangerous: Patients can face delayed or cancelled care, including emergency diversions and surgery disruption, and the academic and research operations of the health system are also affected.

Are you affected?

You are affected if you are a patient, staff member, or student relying on University of New Mexico Health System facilities or systems.

University of New Mexico Health System / UNM Health Sciences Center: clinics across New Mexico, the Level I trauma center, and related IT systems.

What to do

  1. Follow official UNM Health updates before visiting any facility or calling about an appointment
  2. If you were scheduled at a cancelled clinic, contact UNM Health directly to reschedule
  3. Watch for phishing emails or calls that exploit the outage and ask for personal or payment details

Timeline

  1. 27 Oct 2026, 18:49 UTC
    Publicly disclosed
  2. 27 Oct 2026, 18:49 UTC
    Reported by DataBreaches.net · DataBreaches.net
  3. 27 Oct 2026, 18:56 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 22:08 UTC
    BleepingComputer reported on it · BleepingComputer
  5. 27 Oct 2026, 22:08 UTC
    Reported by BleepingComputer
  6. 29 Oct 2026, 20:10 UTC
    Reported by DataBreaches.net · DataBreaches.net

Sources 3 reports, oldest first

Security press established security newsrooms

Technical details

ID
ZR-1bfec360 · ZR-9bba3489
Disclosed
27 Oct 2026, 18:49 UTC
On Zero Radar
27 Oct 2026, 18:56 UTC (7 min after disclosure)
Last change
29 Oct 2026, 20:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

University of New Mexico Health hit by ransomware, care disrupted · Zero Radar