Early Monday afternoon, a University of New Mexico Hospital (UNMH) employee reported hearing an audio message on their computer that declared, “UNMH has been hacked” and warned that “We have personal information of employees and students.” The hospital has not officially confirmed the incident, but the message triggered immediate operational changes that affect Albuquerque and the broader New Mexico community.
UNMH posted a notice on its website stating that ambulance services were being diverted to other hospitals, specifically Presbyterian Hospital and Lovelace Medical Center. The diversion meant that emergency responders in Albuquerque and surrounding areas had to reroute patients to facilities farther away, potentially lengthening response times for critical care.
In addition to emergency services, the hack forced the cancellation of appointments and outpatient surgeries at more than 30 clinics across the state. Non‑essential staff were dismissed for the day, and classes for health‑sciences students were also canceled, disrupting education and training for future medical professionals.
By 2:30 p.m. Monday, UNMH reported that it had begun restoring its computer systems and was working to bring operations back online. The hospital has not disclosed the specific cause of the breach, but cybersecurity experts consulted by KOAT offered possible explanations.
Efrain Lopez, a computer‑science professor at New Mexico State University, noted that “in 2026, there were already around 200 or 300 cyber attacks targeting hospitals,” indicating that such attacks are increasingly common. Lopez suggested the UNMH incident could be a ransomware attack, though the hospital has not confirmed this. He explained that a typical scenario involves an employee opening a phishing email that installs malware, granting hackers access to the hospital network.
Safety expert Paul Szych added that large institutions like hospitals are attractive targets because of the potential for financial and informational gain. “They can apply for lines of credit, attempt to register your home’s name into a fictitious name, and then attempt to take over a title. They can wreck your credit,” Szych said.
Both experts emphasized the importance of employee training to prevent future breaches. Szych highlighted phishing training as a primary defense, stating that employees need to learn how to recognize malicious emails before they can cause damage.
Sources: koat.com
