UNM Health cyberattack disrupts patient care: what we know and what to learn

The incident is a reminder that for healthcare organizations, and for any business with critical operations, ransomware is first an availability problem. The available reporting is short, so this post sticks to what has been stated and flags what is still unknown. What happened BleepingComputer reports that the University of New Mexico Health Sciences Center disclosed a cyberattack.

The attack caused system outages and disrupted both patient care and academic activities. BleepingComputer's headline says the incident is a ransomware attack and that surgeries were disrupted. The sources I have do not say: how the attackers gained access which threat group, if any, is responsible whether data was stolen or encrypted whether a ransom demand was made how long it will take to restore affected systems I am not going to speculate on any of these.

The primary article and UNM's own statements are the right places to look for updates. Why it matters Even with few details, the incident shows a few things engineers should keep in mind. Impact is operational.

Discussions of ransomware often focus on data theft and extortion. In a hospital and university setting, the visible effect here is outages that affect care delivery and teaching. Uptime and recovery speed matter as much as confidentiality.

Large, mixed environments are hard to defend and hard to restore. An academic health center combines clinical systems, research, and education. Restoring such an environment means deciding what comes back first, and that decision is much easier if it was made before an incident.

Downtime is a process problem, not only a technical one. When systems are unavailable, staff need tested manual procedures. That is organizational preparation, and engineers often help build it.

What you should do No indicators of compromise, vulnerabilities, or specific mitigations have been published in the sources I used, so there is nothing to patch for this incident. The following is general hygiene, not a response to a specific finding: Test restores, not just backups. Verify that you can recover critical systems within a time your business can tolerate.

Isolate backups. Keep at least one copy that cannot be reached or deleted with everyday admin credentials. Map your recovery order.

Document which systems and dependencies (identity, DNS, networking) must return first. Rehearse an outage. Run a tabletop or live exercise where primary systems are assumed unavailable, and include non-technical teams.

Review access paths. Check remote access, privileged accounts, and MFA coverage, since these are common focus areas in ransomware defense generally. Prepare communication.

Know who speaks to staff, customers, and regulators, and through which channels, if your normal ones are down. If you are in healthcare IT or supply a healthcare organization, watch for official guidance from UNM and relevant authorities as more is disclosed.