A major hospital network in New Mexico raced to fix a cybersecurity issue on Monday that forced it to send ambulances to other hospitals and left the state without an emergency department capable of treating the most serious injuries. The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque and canceled appointments at its more than 30 clinics.
What happened
The disruption hit a network that carries a large share of the state's care. The hospital network conducts about 900,000 outpatient visits and receives 100,000 emergency room visits each year, according to its website. It operates the state's only Level 1 trauma center.
The response was visible to patients rather than confined to internal systems. Ambulances were routed to other hospitals, people were told not to come to the main hospital in Albuquerque, and clinic appointments were canceled across the network.
A spokesperson for the health system wouldn't comment, saying that the incident remains an active law enforcement investigation. No party has been confirmed as responsible, and the cause has not been described publicly.
How it was done
Little has been confirmed about the method. The clearest detail comes from staff accounts of what appeared on their screens.
Multiple UNM Health System employees said they heard messages across their computers while working late Monday morning that claimed to have stolen student and employee data and patient information.
Those messages are claims made to staff, not verified findings. Whether data was taken, and how access was obtained, has not been established in public reporting.
What to check
If your organisation runs clinical or other safety critical operations, these checks are worth running this week.
Confirm your diversion and downtime plan is current
Open the written downtime procedure and check the date it was last revised and tested. Walk one department through registering, ordering and charting on paper for an hour. A bad result is a plan that names systems or staff who no longer exist.
Test whether clinical systems survive an identity outage
Map which applications depend on a single directory or single sign on provider. In a test tenant, disable that provider and see which clinical workflows still function. If every ordering and results path fails together, you have one failure domain, not many.
Verify backups restore, not just complete
Pick one critical database and restore it to isolated infrastructure. Time the restore end to end and compare it against the recovery time your clinical leaders assume. Backups that are reachable with the same credentials as production are not a recovery plan.
Look for mass message and remote execution capability
Review who can push a message, script or package to every endpoint through your management tooling, for example a configuration management console or remote execution agent. List the accounts holding that right and remove any that are shared or unused. Check the tool's own audit log for jobs you cannot attribute.
Hunt for bulk data movement from clinical stores
Query egress logs and database audit logs for large reads or transfers from record systems outside normal reporting windows. Alert on volumes well above a department's baseline. Unexplained outbound transfers to new destinations deserve same day review.
Set the out of band communications path
Confirm staff can reach incident leadership if email, chat and the intranet are unavailable. Keep a printed contact tree and a tested alternate channel, and name who speaks to patients and to law enforcement. Test it with an unannounced call round.