What we know about the UNM Health System outage that closed 30 clinics and diverted ambulances

The University of New Mexico Health System was still working to resolve a cybersecurity issue on Monday, Oct. 26, 2026, after the disruption forced ambulances to be diverted to other hospitals and left the state without an emergency department capable of treating the most serious injuries.

The network told people not to come to its main hospital in Albuquerque and canceled appointments at more than 30 clinics. Clinics were closed at UNM Sandoval Regional Medical Center in Rio Rancho. UNM Health System said it was working to resolve the issue. The extent and nature of the problem was not immediately clear.

That last point matters. As of Monday, there was no public confirmation of what kind of incident this was — ransomware, a breach, a failed system, or something else. No source has said patient data was accessed or compromised. No threat actor has been named. Those questions remain open, and they should be answered before anyone draws conclusions about cause or culpability.

What is not in question is the operational footprint. UNM Health System handles about 900,000 outpatient visits and 100,000 emergency room visits each year, and it operates the state's only Level 1 trauma center. That designation is not administrative. It is the capacity to treat the most severe injuries — major trauma, complex multi-system damage — around the clock. When that capacity goes offline, the next patient who needs it does not get a substitute in state. They get a longer transport, a delayed intervention, or a hospital that is not equipped for what they have.

This is the part of healthcare cybersecurity that rarely makes it into incident reports. A hospital network is not just a data custodian. It is physical infrastructure, and its digital systems are load-bearing. Scheduling, imaging, records, pharmacy, admissions, and bed management all run on software. When those systems fail or are taken offline, the clinical operation does not degrade gracefully. It stops accepting patients.

Monday's disruption is a live demonstration of a single point of failure at state scale. One network's systems went down, and an entire state temporarily lost its highest tier of trauma care. The diversion of ambulances was not a precaution. It was the system routing around a hole.

For healthcare security teams, the practical lessons are not new, but they are worth restating while the details of this incident are still unknown.

• Assume clinical downtime is a patient-safety event, not an IT event. Downtime procedures should be rehearsed by clinical staff, not just documented. If the electronic health record goes offline, the paper fallback needs to work at 3 a.m. on a Monday. - Map your single points of failure. Identify which systems, if unavailable, force diversion or closure. Those systems deserve the strongest segmentation, the most aggressive patching, and the most tested recovery. - Segment clinical and corporate networks. Ransomware and destructive intrusions spread laterally. Detection should focus on anomalous authentication, unusual lateral movement, and mass file modification. - Coordinate with regional partners before an incident. Diversion plans, mutual-aid agreements, and trauma-routing protocols should be settled in advance, not improvised during an outage.

New Mexico spent Monday without its only Level 1 trauma center. The cause is still unknown. The dependency is not.