When a Cyber Attack Reaches the Emergency Room: What This Week’s Headlines Teach Us

Most people think of cyber attacks as problems for computers: stolen passwords, leaked files, locked screens.

This week's biggest story shows the human side. On Monday 26 October 2026, a cyber attack hit the University of New Mexico's health system. Ambulances were diverted to other hospitals, new admissions were limited, and outpatient surgeries and appointments were suspended for the day (BleepingComputer, 2026).

The hospital's computers were the target, but patients were the ones affected.

What Happened

UNM Health is a major provider of specialist care in the US state of New Mexico. It handles more than a million patient visits a year, and its hospital in Albuquerque has the state's only Level I trauma center, which treats the most seriously injured patients (BleepingComputer, 2026).

When the attack was discovered, the health system cancelled scheduled appointments and outpatient surgeries and temporarily sent ambulances elsewhere. Other hospitals in Albuquerque and Santa Fe took in the redirected patients (PCrisk, 2026). Reports say the ambulance diversion lasted about two hours, and UNM later said its hospitals and clinics had reopened (EMS1, 2026; Digg, 2026).

A ransomware group called Byod, which appears to be new, claimed responsibility. It said it had compromised 36,000 systems and taken patient and employee data (Albuquerque Journal, 2026). UNM has not confirmed those claims. Officials said only end-user devices were affected, not the core servers, and that the university made no concessions to the hackers. The FBI is carrying out a forensic analysis (EMS1, 2026).

One strange detail, the group later said it would give healthcare facilities free decryption keys and pay up to $2,500 per affected patient (BleepingComputer, 2026). That is only an offer from criminals, and it should not be read as the group being trustworthy.

A note on what is confirmed: the disruption to care is confirmed. The size of the data theft is so far only the attackers' claim. Early reports from attackers are often exaggerated, so treat the 36,000 figure as unverified.

What Is Ransomware, in Plain Words?

Ransomware is malicious software that locks a victim's files or systems, often after the criminals have also copied the data. They then demand payment to unlock the files or to keep the stolen data private.

This is why hospitals are so exposed. A shop can close for a day, but a hospital cannot easily stop treating people. Criminals know that pressure can push victims to pay.

It Is Not Just One Hospital

The UNM attack was one of many in October 2026. One monthly roundup listed incidents across retail, aviation, finance, technology and government (Cyber Management Alliance, 2026). A few examples:

• Technical University of Denmark (4 October): a hack that potentially exposed about 200,000 people.

• IDC Frontier, Japan (7 October): a ransomware attack forced the company to shut down affected systems in a cloud data center and disable customer access to its management consoles.

• Osaka Metropolitan University: a suspected ransomware attack led to cancelled classes, with personal data of at least 130,000 people potentially exposed.

• MoneyGram: hackers claimed a data breach, which had not been independently verified at the time of the roundup.

One tracker counted 106 dated incidents in October alone. It reported that most began with stolen credentials or trusted software update channels (ExplainX, 2026). That is a single vendor's count, but it matches a pattern security team have warned about for years: attackers often walk in with a real login rather than break down the door.

Three Lessons from This Week

1. Cyber attacks now threaten safety, not just privacy.
When hospital systems fail, the risk is delayed surgery or a longer ambulance ride, not only exposed records. Protecting hospitals is a public safety issue.

2. Stolen logins are the open door.
Many attacks start with a password someone reused, a phishing email, or a compromised software update. Basic habits matter more than most people think.

3. The first reports are rarely the full story.
Criminal gangs exaggerate to create pressure. Organizations often take weeks to confirm what was really taken. It is wise to wait for confirmed facts before drawing conclusions.

What You Can Do

As an individual

• Use a different password for every account, with a password manager to remember them.

• Switch on two-factor authentication, especially for email and banking. Passkeys, where offered, are even safer.

• Be wary of urgent emails and texts. If a message pressures you to click, stop and check through another channel.

• Keep phones and computers updated.

• If you receive a breach notice from a hospital or company, take it seriously. Change related passwords and watch for scams that use your details.

As a business or organization

• Keep offline backups and test restoring them. Backups are the best defense against being forced to pay.

• Limit who can access what, so one stolen login cannot open every door.

• Have a written incident plan and practice it, including how to keep operating if systems go down.

• Check the security of suppliers and software updates since attackers often come in through trusted channels.

The Bottom Line

There was no single world cyber attack this week. The picture is a steady stream of attacks, with healthcare the most worrying target because lives are at stake.

The UNM Health attack shows how digital crime can reach the real world within hours. It also shows that preparation works neighboring hospitals absorbed patients, services were restored, and the health system says it did not give in to the demands.

Cyber security is no longer only an IT matter. It is part of keeping hospitals, schools, utilities and businesses running, and everyone has a small part to play.

References

Albuquerque Journal (2026) UNM Health has not made concessions to hackers after cyberattacking, officials say. Available at: https://www.abqjournal.com/news/unm-health-has-not-made-concessions-to-hackers-after-cyberattack-officials-say/3151088 (Accessed: 5 November 2026).

BleepingComputer (2026) UNM Health ransomware attack disrupts patient care, surgeries, 27 October. Available at: https://bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries (Accessed: 5 November 2026).

Cyber Management Alliance (2026) Biggest cyber-attacks, data breaches, ransomware attacks: October 2026, 2 November. Available at: https://www.cm-alliance.com/cybersecurity-blog/biggest-cyber-attacks-data-breaches-ransomware-attacks-october-2026 (Accessed: 5 November 2026).

Digg (2026) UNM Health restores services after cyberattack disrupted patient care. Available at: https://digg.com/tech/x5spp7ql (Accessed: 5 November 2026).

EMS1 (2026) N.M. hospital denies ransom payment after cyberattack diverts ambulances. Available at: https://www.ems1.com/cybersecurity/n-m-hospital-denies-ransom-payment-after-cyberattack-diverts-ambulances (Accessed: 5 November 2026).

ExplainX (2026) November 2026 cyberattacks: the full list of incidents, counted by type, 1 November. Available at: https://explainx.ai/blog/november-2026-cyberattacks-list-breaches-exploits-ai-run-attacks-tracker-2026 (Accessed: 5 November 2026).

PCrisk (2026) UNM Health ransomware attack diverts ambulances and halts surgeries. Available at: https://www.pcrisk.com/internet-threat-news/36085-unm-health-ransomware-attack-diverts-ambulances-and-halts-surgeries (Accessed: 5 November 2026).