Ransomware breach at UNM Health Sciences Center halts surgeries and patient services

The University of New Mexico Health Sciences Center announced that a ransomware intrusion forced the shutdown of key computer systems, interrupting the delivery of patient care and halting many scheduled surgeries across its hospitals and clinics.

According to the center, the attack disabled electronic medical records, laboratory interfaces, imaging archives and scheduling tools, compelling clinicians to revert to manual, paper‑based processes. The loss of real‑time data led to the postponement of elective procedures and delayed routine appointments, while emergency teams continued to operate under heightened caution.

Cybercriminals have increasingly targeted health‑care organizations, drawn by the sector’s reliance on uninterrupted digital access to patient information. Such attacks can jeopardize not only privacy but also clinical outcomes when clinicians cannot quickly retrieve critical data. UNM officials noted that the breach underscores the vulnerability of even well‑funded academic medical centers to sophisticated malware.

In response, the university said it has engaged federal law‑enforcement partners and leading cybersecurity firms to contain the breach, assess any potential data exposure, and begin system restoration. While investigators have not confirmed that patient records were exfiltrated, the center warned that personal health information could be at risk and pledged to notify affected individuals should evidence of theft emerge.

The outage also rippled through the institution’s educational mission. Classrooms, research labs and teaching hospitals reported interruptions, forcing faculty to modify curricula and students to rely on offline resources. Ongoing research projects that depend on digital data collection have been placed on hold pending the return of secure network services.

Recovery timelines remain uncertain, with administrators emphasizing a methodical approach to rebuilding and hardening the network against future attacks. The incident has prompted calls for broader investment in cyber‑defense across the state’s health system, as providers grapple with the dual pressures of maintaining patient safety and protecting sensitive information in an increasingly hostile digital landscape.