Key Takeaways

  • University of New Mexico Health System canceled appointments and temporarily diverted ambulances following a ransomware attack.
  • The disruption shows how cyber incidents can quickly affect clinical operations, regional emergency capacity, and patient safety.
  • Healthcare leaders are increasingly treating recovery time, downtime procedures, and care continuity as core cybersecurity measures.

University of New Mexico Health System canceled appointments and temporarily diverted ambulances after a ransomware attack disrupted operations, turning a security incident into an immediate care-delivery problem. The response illustrates a hard reality for healthcare executives: ransomware can move from the server room to the emergency department very quickly.

Temporarily redirecting ambulances may help protect patients when clinical teams cannot reliably access the systems, records, communications, or workflows needed to receive them. But diversion transfers pressure elsewhere. Nearby hospitals can face higher emergency volumes, longer handoffs, and tighter bed capacity, particularly if the affected institution serves as a major regional care center.

Canceled appointments create a different kind of backlog. Patients may need to reschedule diagnostics, procedures, follow-up visits, or specialty consultations, while staff work through both interrupted care and the normal appointment queue. Some delays are inconvenient. Others can become clinically significant depending on the patient and service involved.

That is why the University of New Mexico Health System incident matters beyond New Mexico. Nearly half of 374 U.S. healthcare ransomware attacks examined in an analysis reported by The Healthcare Executive involved some form of care disruption, including electronic-system downtime, canceled care, or ambulance diversion.

Traditional breach metrics do not fully capture that operational impact. Investigators may eventually determine whether protected health information was accessed or removed, but operational harm can begin before that answer is available. A hospital may isolate systems as a precaution, disable network connections, or shift to paper processes while forensic work continues.

The broader threat level remains high. Axis Intelligence, citing the FBI's 2025 Internet Crime Complaint Center data, reported 460 ransomware complaints from the U.S. Healthcare and Public Health sector. That was the highest total among critical-infrastructure sectors. Separately, HHS data indicated that at least 61.6 million healthcare individuals had protected health information exposed or impermissibly disclosed during 2025.

Clinical consequences may extend beyond diversions and scheduling. A 2026 University of Minnesota study reported that in-hospital mortality among patients already admitted when a ransomware attack began increased from 34% to 38%, according to Paubox. Such findings do not mean every attack produces the same result, but they strengthen the case for treating cyber resilience as part of patient-safety planning.

There is precedent. The 2024 Ascension attack caused ambulance diversions across a system spanning more than 140 hospitals. Change Healthcare and McLaren Health Care have also demonstrated how attacks on healthcare infrastructure can ripple through payment, pharmacy, clinical, and administrative processes. A single compromised environment can affect far more than one IT department.

So what should boards measure? Preventive controls still matter, including timely vulnerability remediation, multifactor authentication, network segmentation, endpoint monitoring, and privileged-access management. Yet recovery metrics deserve equal attention. Leadership teams can track how long critical applications can remain unavailable, whether departments can operate safely on paper, and how quickly clean backups can restore prioritized clinical services.

Technologies such as Microsoft Sentinel, CrowdStrike, and Palo Alto Networks may support detection and response, but product selection should follow clinical downtime requirements rather than lead them. A sophisticated alerting platform offers limited value if the hospital has not rehearsed medication administration, laboratory ordering, imaging, patient transfer, and emergency intake during system isolation.

Preparation exercises need to include more than cyber personnel. Emergency physicians, nurses, pharmacy leaders, laboratory teams, communications staff, legal counsel, emergency medical services partners, and executive decision-makers all have roles. Plans should also establish who can authorize ambulance diversion, how patients will be notified about canceled appointments, and which systems receive restoration priority.

University of New Mexico Health System's experience is another warning that healthcare ransomware cannot be managed solely as a privacy or compliance issue. The practical test is whether care can continue safely while technology teams contain the attack. For hospitals, recovery speed is no longer just an IT performance measure. It is an integral part of clinical readiness.