On Monday, October 26, 2026, a cyberattack forced the University of New Mexico Health System to divert ambulances, cancel outpatient surgeries and cancel appointments at its more than 30 clinics. Staff were told to power off and unplug their computers, and critical systems did not come back until early the next morning. UNM says the attack reached some staff computers but not its core servers, and that it paid no ransom.
If you run a medical or dental office in Los Angeles, this is the story to read this week, not because hospitals get hit, but because of what it shows about the first hours. Three things decide whether an attack costs you one day or one month: how fast someone spots it and cuts it off, whether your backups are out of the attacker's reach, and whether your front desk can keep seeing patients on paper while IT works. Below is what staff and patients actually ran into, the numbers behind attacks like this, a 10-minute self-check, and the fixes in the order we would make them.
Monday morning at UNM Health: what staff and patients ran into
UNM Health is not a small system. It runs New Mexico's only Level 1 trauma center and handles about 900,000 outpatient visits and 100,000 emergency room visits a year, according to the Associated Press report carried by SecurityWeek (opens in a new tab). Its Health Sciences Center also includes a children's hospital and the state's only burn unit, The Record (opens in a new tab) reported.
For the people at their desks, the attack started with something odd on their screens. The AP reported that employees heard messages across their computers claiming the attackers had stolen student and employee data and patient information. The student newspaper, The Daily Lobo, reported that the attackers played a synthetic voice message on hospital workers' computers that claimed the theft of personal data and Social Security numbers and urged administrators to contact them through an encrypted messaging service, according to Help Net Security (opens in a new tab).
Then came the order every office manager should picture happening in their own building. Help Net Security, citing an internal message to healthcare workers, reported that the breach was detected around 11:30 a.m. and that about 40 minutes later staff were told to power off and disconnect their computers and to turn off Wi-Fi on their mobile devices. UNM's own updates, summarized by The HIPAA Journal (opens in a new tab), put the start of containment at about 11 a.m. Either way, within the first hour the hospital chose to go dark on purpose rather than let the attack spread.
Patients felt it right away. Ambulances were sent to other hospitals. People were told not to come to the main Albuquerque hospital. Every clinic appointment and outpatient surgery that day was canceled. Students at the schools of medicine, nursing, pharmacy and population health were asked to leave campus, and classes stayed canceled for a second day. The Register (opens in a new tab) reported that leadership activated an Emergency Operations Center and that everyone except critical and clinical staff was sent home. Two other large providers, Presbyterian and Lovelace, took extra patients, and the FBI said it was assisting.
| When | What happened |
|---|---|
| Oct. 26, about 11:00 to 11:30 a.m. | Attack detected; IT begins containment |
| About 40 minutes later | Staff told to power off and unplug computers and turn off Wi-Fi on phones |
| Oct. 26, 12:30 p.m. | Ambulances diverted to other hospitals as a safety step |
| Oct. 26, 2:30 p.m. | Ambulance diversion ends; new patient acceptance still limited |
| Oct. 26, all day | All clinic appointments and outpatient surgeries canceled; students sent home |
| Oct. 27, early morning | Critical systems restored; ambulance traffic back to normal; classes still canceled |
| Oct. 28 | UNM says all facilities are fully functional and no ransom was paid |
Through it all, the hospital said very little, and that is normal. Its update on the evening of October 26, quoted by Help Net Security, said: "Because this remains an active law enforcement investigation, we are limited in what we can share at this time." If your office is ever hit, expect the same pressure: patients and staff will want answers long before you have them.
Big claims, a careful denial, and a second wave of scams
A new ransomware group calling itself Byod claimed the attack on its leak site. BleepingComputer (opens in a new tab) quoted its post: "This is your entire network and infrastructure compromised, the entire university COMPLETELY." The group claimed it had compromised 36,000 systems and taken payroll records, student records, internal email and Cerner health record rosters. None of that has been confirmed.
UNM's assessment is very different. It says the event affected some end-user devices but did not penetrate core systems or servers. In other words, the attackers got onto the computers people use every day, and the hospital believes it stopped them before they reached the systems that hold the records. Whether any patient data left the building is still under investigation.
Then the story turned strange. According to The Record, the group apologized on Tuesday, said it had not known the computers were used for patient care, and offered free decryption keys. Its message included the line: "We have morals and we have a heart, we are not villains." In the same breath, it said it would keep the stolen data and made public offers involving payments of $2,500 tied to that data.
UNM did not engage. Its warning to patients, students and staff began: "Following a cybersecurity incident, those responsible may attempt to exploit individuals through additional scams." It told people not to respond to anyone claiming responsibility, not to click links, open attachments or share personal or financial information, and to save any message and report it to the FBI's Internet Crime Complaint Center.
That second wave is the part small practices forget to plan for. After any breach, criminals and copycats contact patients by email, text and phone, pretending to be the office, the attacker or a refund service. A patient who gets a convincing text the week after your office was in the news has no way to know it is fake unless you told them in advance how you will and will not contact them.
What a day without computers looks like inside a clinic
UNM was back within about a day. That is the good outcome, and it is not guaranteed. The week before, University Hospitals in Cleveland disconnected its systems from the internet after it saw suspicious activity on its servers. Days later, a spokesperson told Cleveland 19 (opens in a new tab): "We have rescheduled some appointments and elective procedures." Patients still could not use the MyChart portal, staff were struggling with insurance pre-authorizations, and no restore date had been given.
Nurses who lived through a longer outage have described what that feels like on the floor. During the 2024 ransomware attack on Ascension hospitals, an anonymous nurse in Michigan told CNN (opens in a new tab): "I can't see what labs are ordered and their results." A nurse in Alabama said: "It is frightening how many safety guardrails [have been] out of service without any computers."
Now shrink that to a four-chair dental office in Encino or a family practice in Santa Monica. The schedule lives in the practice management system, so nobody knows who is coming in. X-rays and intraoral images sit on an imaging server that is now unplugged. Insurance eligibility checks, claims and card payments all run through the same network. The phones may work, but the patient list you would call from is on a locked computer. Staff are on the clock with nothing they can safely touch. Every hour is lost production, and then come the days of catching up, the patient questions about their data, and the legal work of deciding who has to be notified.
Tufts University cybersecurity policy professor Josephine Wolff told the AP that the UNM incident shows "how much work we still have to do to get better at defending ourselves." That applies even more to small offices, which have none of a hospital's in-house security staff.
The numbers behind healthcare ransomware in 2025 and 2026
This is not a rare event, and Los Angeles is not out of range. The FBI's 2025 Internet Crime Report (opens in a new tab) counted 460 ransomware complaints from the healthcare and public health sector, more than from any other critical infrastructure sector, as The HIPAA Journal summarized (opens in a new tab). California led every state in both complaints and losses.
| Statistic | Number | Source |
|---|---|---|
| Ransomware complaints from healthcare and public health | 460, the most of any critical sector | FBI IC3 2025 report |
| Ransomware losses reported to the FBI, all sectors | $32.3 million (the FBI says this does not normally include lost business, time, wages or outside recovery help) | FBI IC3 2025 report |
| California cybercrime complaints and losses | 116,414 complaints and $3.67 billion, both first in the nation | FBI IC3 2025 report |
| Most common root cause of healthcare ransomware | Exploited vulnerabilities 33%, malicious email 22%, stolen credentials 18% | Sophos State of Ransomware in Healthcare 2025 |
| Most common operational cause | Not enough people watching systems, 42% | Sophos 2025 |
| Average cost to recover from an attack | $1.02 million | Sophos 2025 |
| Healthcare providers recovered within a week | 58% | Sophos 2025 |
| Encrypted data restored from backups | 51%, the lowest in four years | Sophos 2025 |
| Average cost of a healthcare data breach | $6.64 million, highest of any industry | IBM Cost of a Data Breach 2026 |
| Breaches that involve ransomware, all industries | 48% | Verizon DBIR 2026 |
Two numbers in that table matter most for a small practice. The first is the root cause list from the Sophos State of Ransomware in Healthcare 2025 (opens in a new tab) survey of 292 healthcare organizations with 100 to 5,000 employees. One in three attacks started with an exploited software flaw, and two in five involved security gaps the organization already knew about. Those are fixable problems, not bad luck.
The second is the backup number. Only about half of the providers that had data encrypted got it back from their own backups. The rest paid, used other methods, or both. A backup you have never tested is a hope, not a plan.
The cost figures show why this matters to owners, not just IT. IBM's 2026 study, as reported by The HIPAA Journal (opens in a new tab), put the average healthcare breach at $6.64 million and the average United States breach at $11.5 million. A small office will not see numbers that size, but the parts are the same: days closed, staff paid to wait, outside experts, legal advice, notification letters and patients who quietly move to another practice. The Verizon 2026 Data Breach Investigations Report (opens in a new tab) found ransomware in 48% of all breaches, which is why it belongs at the top of any practice's risk list.
What was missed, and what worked
Because UNM has not shared how the attack started, nobody outside the investigation can name the exact control that failed. What the public facts do show is where the attack landed: staff workstations, the computers your front desk, assistants and billing team use all day. Those machines are where phishing emails are opened, where passwords are typed, and where remote access tools get installed. They are also the easiest place for an attack to spread from if nothing is watching them.
What worked is just as useful. Containment started within the first hour. Staff got a clear, simple instruction: power off, unplug, turn off Wi-Fi. The damage stayed off the core servers, which may mean workstations were kept apart from the systems that hold the records. An emergency operations team took charge, outside security partners helped secure the network, and neighboring health systems took patients so care continued. A small practice can copy every one of those moves at its own size.
The controls behind those moves are not exotic. The federal #StopRansomware Guide from CISA (opens in a new tab) lists offline, encrypted, tested backups first in its preparation advice and calls for phishing resistant multifactor authentication on all services. Its response checklist starts with finding the affected systems and isolating them immediately, and it advises using phone calls instead of email while you do it, so the attacker does not see you coming. Modern endpoint detection and response can isolate an infected computer from the network in seconds, which is the small office version of the shutdown order UNM gave by hand.
Your 10-minute self-check, plus four free tools
You do not need an IT degree to find out where your office stands. Set a timer for 10 minutes and work through this table with your office manager. Any answer in the red flag column is a gap worth fixing this month.
| Check | How to do it | Red flag |
|---|---|---|
| Backups | Ask your IT provider when they last restored a real file from backup, and where the offline copy lives | Nobody knows, or the only copy is on a drive plugged into the server |
| Watched endpoints | Ask who would see an alert on the front desk computer at 11 a.m. on a Monday, and at 2 a.m. on a Sunday | The answer is the antivirus pop-up, or nobody |
| Email sign-in | Open a private browser window and sign in to your work email | You get in with a password alone, no second step |
| Remote access tools | Look at installed programs on two staff computers for AnyDesk, TeamViewer, ScreenConnect or similar | A tool you did not approve, or one nobody can explain |
| Paper fallback | Try to print tomorrow's schedule and patient phone numbers right now | You cannot, or it would take longer than five minutes |
| Call list | Find the phone numbers for your IT provider, cyber insurer and attorney on paper | They only exist in email or a phone you might have to turn off |
| Patient message | Ask whether you have a ready message telling patients how you will and will not contact them | No message exists |
Then use our free tools to put numbers on it. The downtime cost calculator takes your team size, hourly cost and outage length and shows what a closed day really costs, which is the number to bring to any budget conversation. The cybersecurity score asks 12 yes or no questions about MFA, patching, endpoint protection, backups and training and gives you a score out of 100 with a list of what to fix first, in about three minutes.
Since stolen credentials were behind 18% of healthcare ransomware attacks in the Sophos survey, run the passwords your team actually uses through the password leak check. It tells you whether a password appears in known breaches, and it is hashed in your browser so the password itself is never sent. And because malicious email started another 22% of attacks, have every staff member take the five-minute phishing quiz, which shows eight realistic emails and the clues that give fake ones away.
The fixes, in the order we would make them
1. Prove your backups work
Backups decide how long you are closed, so they come first. Make sure at least one copy of your records system, imaging and billing data sits somewhere a stolen staff password cannot reach, such as an offline or immutable copy. Then restore one real patient file and time it. If nobody has done a test restore this year, that is your first task. Our guides to the 3-2-1 backup rule and backup testing explain the setup in plain terms.
2. Put a watched alarm on every computer
Every workstation and server should run endpoint detection and response that a person actually monitors around the clock, with the power to cut a machine off the network the moment it acts strangely. Sophos found that the most common operational cause of healthcare attacks was not enough people watching systems. Small offices fix that by having a provider watch for them.
3. Patch the doors attackers use most
Exploited vulnerabilities were the top root cause in the Sophos survey. Keep firewalls, VPNs, remote access tools and Windows up to date, starting with anything that faces the internet. If a device is too old to get updates, plan to replace it.
4. Lock down sign-ins and remote access
Turn on multifactor authentication for email, remote access, your practice management system and your records logins. Remove any remote access tool your IT team did not install, and make sure former employees and vendors no longer have accounts.
5. Keep workstations away from the records server
UNM says the attack stayed on end-user devices and never reached its core systems. In a small office, that means the front desk computers, guest Wi-Fi and staff phones should not have open paths to the server that holds patient records and images. Your IT provider can set this up on the firewall and network you already have.
6. Build a paper downtime kit and a call list
Print the next two days' schedule and patient phone numbers each evening, or set up an automatic export. Keep paper intake, consent and treatment forms ready. Write down the numbers for your IT provider, your cyber insurer and your attorney, and keep a copy outside the office. Our guide to EHR downtime procedures lists what belongs in the kit.
7. Write the patient message and practice the first hour
Write two or three sentences now that tell patients you will never ask for payment or personal details through an unexpected message, and give them a phone number they already know. Then run a short tabletop exercise where you walk through UNM's first hour in your own office: who decides to unplug, who calls IT, who calls patients. If you ever need it, read up on the HIPAA Breach Notification Rule, because deciding whether an attack is a reportable breach is one of the first questions you will face.
How GlobeVM helps LA practices stay open
GlobeVM was founded in 1996, and today we have "75+ organizations supported across Southern California." For medical practices and dental offices, the protections in this article are not extras. In our words: "Every client gets firewall management, endpoint protection, email filtering, and MFA as part of the plan, not as an add-on." Our promise on response is short: "15 min response time, around the clock."
When something goes wrong, you are not opening a ticket. "When you call GlobeVM, you reach George or Nazy directly. Not a ticket queue. Not a call center overseas." We sign a HIPAA business associate agreement when a practice needs one, and "We proudly serve LA's Persian business community in both languages," English and Farsi.
One Beverly Hills client, R. Yadegar, wrote: "After a ransomware attack, GlobeVM recovered all our data in hours." We would rather help you never need that call. If you want to know how your office would hold up on a day like UNM's, book a free IT assessment. We will check your backups, endpoint protection, sign-ins and remote access with you and tell you plainly what to fix first.