University of New Mexico hospital diverts ambulances after cyberattack

Ambulances were diverted from the University of New Mexico Health System after a cyberattack caused significant issues for the organization on Monday. 

The organization said it suffered a cyberattack on Monday that forced the organization’s IT team to contain the issue and notify federal law enforcement. 

For about two hours on Monday, the organization diverted ambulances to health systems in Albuquerque and Santa Fe. They were forced to suspend outpatient surgeries and appointments for the remainder of the day.

“The cybersecurity threat is affecting the entire University of New Mexico Health Sciences Center,” a spokesperson explained. The Health System is one part of the overarching Sciences Center, which also includes an academic campus and medical research facilities. 

The health system has the state’s only burn unit, children’s hospital and Level 1 trauma center, and serves a large percentage of the state’s uninsured population.

Local news outlets reported that employees got an alert on their phones notifying them of the cyberattack and instructing them to turn off and unplug all desktops. Employees were asked to disconnect all mobile devices from the hospital Wi-Fi. 

Late in the afternoon on Monday, the University of New Mexico Health System began resuming operations and bringing systems back online. Patients who had appointments or procedures cancelled on Monday will be rescheduled, a spokesperson said. 

In an updated statement late on Monday, a spokesperson said all appointments will resume as scheduled on Tuesday but classes at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health are canceled on Tuesday. This includes online and remote classes.

UNM Health Sciences academic and research units will also remain closed on Tuesday. Nonessential employees at the UNM Health Sciences Center were asked to remain home on Tuesday.

“We recognize this event may have impacted patients, employees and students, and we appreciate their patience as our teams respond,” the spokesperson said. “Because this remains an active law enforcement investigation, we are limited in what we can share at this time.”

The spokesperson did not respond to requests for comment about whether the incident involved ransomware. 

A ransomware gang known as BYOD took credit for the attack on Monday evening, claiming to have compromised 36,000 machines on the university’s main campus and hospital. The cybercriminals said they stole information on students, patients and employees of the organization. 

BYOD is a new ransomware gang that emerged last month and little is known about the group, with only a handful of named victims. 

This is the second major cyberattack on a large state hospital this year after hackers shut down the University of Mississippi Medical Center in March. That ransomware attack caused chaos in the state for weeks and severely limited operations at the state’s only children's hospital and only Level I trauma center.

Ransomware gangs have repeatedly targeted public services in recent days, taking down dozens of systems run by the city of Columbia, South Carolina last week. City Manager Teresa Wilson confirmed on Friday that they are dealing with a ransomware attack and said several resident-facing systems continued to be knocked offline due to the incident.