[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFLkupfgi6klMrWOQ42fCsYFGbqFwNt0VoKpgZM9RFvs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"2ed60aaf-f70b-4d7e-9d09-635d98abf64c","unm-health-sciences-cyberattack-forces-two-days-of-class-cancellations-and-ambulance-diversions","0ef614a3-ff1f-4e92-bcce-21dc2afc400f","UNM Health Sciences Cyberattack Forces Two Days of Class Cancellations and Ambulance Diversions","A cyberattack targeting the University of New Mexico's Health Sciences Center caused cascading disruptions, including canceled classes, suspended appointments, and ambulance diversions — hallmarks of inadequate network segmentation between administrative, academic, and clinical systems. When a single attack can simultaneously disable university operations and divert emergency medical care, it signals that critical healthcare infrastructure was not sufficiently isolated from broader institutional networks. The multi-day recovery period further suggests incident response plans were either absent, untested, or insufficiently resourced for a healthcare environment. This incident matters because lives can be endangered when hospital operations are disrupted, making healthcare cybersecurity a patient safety issue, not merely an IT concern.","**Immediate actions:**\n- Activate and rehearse your incident response plan immediately, including pre-designated roles for IT, clinical operations, communications, and executive leadership.\n- Implement emergency network segmentation to isolate clinical and patient-care systems from administrative and academic networks during active incidents.\n\n**Long-term improvements:**\n- Design and enforce permanent network segmentation so that a compromise of academic or administrative systems cannot propagate into healthcare operational technology (OT) or electronic health record (EHR) environments.\n- Establish and regularly test downtime procedures for clinical operations so that care can continue safely when systems are taken offline.\n- Conduct annual tabletop exercises that specifically simulate cyberattacks affecting both university and hospital operations simultaneously.\n\n**Detection & recovery measures:**\n- Deploy continuous monitoring and anomaly detection across all network segments, with dedicated alerting for lateral movement between academic and clinical zones.\n- Maintain offline, tested backups of all critical clinical and administrative systems with documented recovery time objectives (RTOs) to minimize multi-day outages.",[12,13,14,15,16,17,18],"CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","GDPR Article 32",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"MITRE ATT&CK T1566: Phishing":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"As a healthcare institution handling patient data, UNM is obligated to implement appropriate technical and organizational measures to ensure resilience of systems — the shutdown of health systems and appointment cancellations indicates this obligation was not fully met.","NIS2 mandates incident handling capabilities for essential service operators, including healthcare; the ambulance diversion and multi-day outage demonstrate that UNM's incident handling capabilities were insufficient to protect essential health services.","Phishing remains the most common initial access vector in healthcare cyberattacks; if this incident originated via phishing, robust email security controls and staff training could have blocked the initial compromise entirely.","Timely identification and remediation of exploitable vulnerabilities across interconnected university and health system networks could have prevented attackers from gaining the foothold needed to cause system-wide shutdowns.","The multi-day disruption to both university and hospital operations suggests the incident response plan lacked tested procedures for healthcare continuity, which this control requires organizations to develop, maintain, and exercise.","A structured technical vulnerability management program would require the university to inventory, assess, and remediate vulnerabilities in health-critical systems before attackers could exploit them to disrupt patient care.","Proper access control and network segmentation between academic and clinical systems would have limited the attacker's ability to move laterally and disrupt hospital operations from a university-side entry point.","published","2026-10-27T17:21:45.732713+00:00","2026-10-27T17:21:45.713+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fcyber-crime\u002F2026\u002F10\u002F27\u002Fday-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack\u002F5305690","day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-cent-1bd3a9","Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[49,53,57],{"slug":50,"name":51,"problem":52},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",{"slug":54,"name":55,"problem":56},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":58,"name":59,"problem":60},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]