UNM Health Sciences Center Ransomware Attack Disrupts Patient Care and Surgeries
Healthcare systems at the University of New Mexico remain offline as recovery and forensic analysis continue
Key Takeaways
- UNM Health Sciences Center confirmed a ransomware attack on October 27, 2026, causing system outages and disrupting patient care and surgeries.
- The specific ransomware variant, threat actor, and scope of data exfiltration have not been disclosed publicly.
- Systems were taken offline to contain the incident; recovery and forensic analysis are ongoing.
- The attack disrupted scheduled surgeries, patient care, and academic activities at the institution.
- No patch or immediate mitigation is available; recovery depends on system restoration and security hardening.
Quick answers
- What happened?
- The University of New Mexico Health Sciences Center confirmed a ransomware attack on October 27, 2026, that caused widespread system outages, disrupted patient care and surgeries, and impacted academic activities. The incident remains under investigation with no official disclosure regarding the ransomware variant, threat actor, or extent of data exfiltration.
- What should defenders do?
- No patch available. Affected organizations should isolate compromised networks, engage incident response teams, and restore systems from verified backups after thorough forensic validation. Enhance network segmentation and backup integrity checks to reduce ransomware risk.
The University of New Mexico Health Sciences Center disclosed a cyberattack on October 27, 2026, that caused system outages and disrupted patient care, surgeries, and academic activities. In a statement, the institution confirmed that its networks were affected by ransomware, leading to significant operational disruptions across its healthcare facilities. The outage forced the cancellation or postponement of scheduled procedures and impacted day-to-day clinical operations. University officials stated that systems were taken offline to contain the incident and begin forensic analysis. As of the latest update, no specific ransomware family, threat actor, or ransom demand has been publicly attributed to the attack. The institution has not released details on whether patient data was exfiltrated. Recovery efforts are ongoing, with IT teams working to restore services securely. The incident underscores the vulnerability of healthcare networks to ransomware and the critical impact such attacks can have on patient safety and care continuity.
Security Details
Ransomware infection; specific variant and exploitation method not specified in source. Systems taken offline for containment and forensic analysis.
Mitigation
No patch available. Affected organizations should isolate compromised networks, engage incident response teams, and restore systems from verified backups after thorough forensic validation. Enhance network segmentation and backup integrity checks to reduce ransomware risk.
Sources
BleepingComputer
UNM Health ransomware attack disrupts patient care, surgeries
Oct 27, 2026 · 22:07
Original link
Related Security News
GMO Group Urges Customers to Shut Down PCs Following Onamae Desktop Cloud Breach
GMO Group has advised customers to disconnect systems from the internet and shut down computers after a threat actor breached the Onamae Desktop Cloud service and threatened to launch a ransomware attack. The advisory was issued amid reports of active exploitation and imminent risk of ransomware deployment.
Gheist Campaign Exploits Stolen GitHub Tokens to Exfiltrate Private Repository Secrets
Security researchers at Wiz report that a threat actor identified as Gheist is using stolen GitHub tokens to inject malicious workflows into target repositories. These workflows are designed to print sensitive secrets—such as API keys and tokens—into GitHub Actions logs. The attackers subsequently download the logs and delete the workflow runs, obscuring their activity. The campaign has been observed affecting private repositories and GitHub Enterprise environments. GitHub has acknowledged the activity and implemented safeguards that pause workflows attempting to output secrets to logs.
