UNM Health System Diverts Level 1 Trauma Patients After Apparent Data Theft Intrusion

The outage began Monday morning when messages appeared on hospital workstations asserting exfiltration of sensitive records. UNM immediately halted non-emergency operations and canceled all outpatient visits while the FBI opened an active investigation. No ransomware note or encryption was publicly confirmed, yet the speed of full system isolation matches patterns seen in prior healthcare intrusions where operators prioritized containment over continued care delivery.

Healthcare delivery data shows UNM handles 100,000 ER visits annually and is the sole Level 1 trauma provider for the state. Diversion of critical patients to facilities already operating near capacity creates measurable mortality risk; similar 2023-2024 incidents at other systems produced documented increases in door-to-needle times and transfer mortality. The public message display on screens, described as unusual by Tufts professor Josephine Wolff, suggests either an unsophisticated actor testing access or an intentional psychological operation rather than standard double-extortion ransomware.

Procurement records and prior HHS breach notifications indicate UNM, like most academic medical centers, runs legacy EHR instances with known unpatched vectors. The absence of immediate attribution from law enforcement aligns with the standard split between technical indicators and official statements; independent confirmation of data exfiltration will require either dark-web posting or victim notification filings, neither of which has surfaced yet.

Expect phased restoration over 48-72 hours followed by mandatory state notification under New Mexico breach law within 30 days. Watch for follow-on claims on extortion forums and any correlated spikes in phishing against the same employee cohort.