Cybersecurity Incident Update at UNM Health Sciences Center: What You Need to Know

Cybersecurity Incident Update at UNM Health Sciences Center: What You Need to Know

The security of patient data and the continuous operation of critical healthcare infrastructure are paramount responsibilities, especially in today's increasingly digitized medical landscape. Recently, UNM Health Sciences Center has been managing a significant cybersecurity incident that requires immediate attention from our community, staff, partners, and patients alike. We understand that news regarding a potential Hospital Cyber Attack is inherently alarming, and we want to provide transparent, technical updates as we work diligently with leading forensic experts and law enforcement agencies.

Our commitment to maintaining the highest standards of Healthcare IT Security remains our absolute top priority. This update serves to clarify what has occurred, what services might be affected, and most importantly, what proactive measures are being implemented to secure our environment. We recognize that terms like "cybersecurity incident" can sound vague, but we aim to provide granular detail regarding the scope of the compromise, the protective actions taken by our dedicated IT teams, and clear guidance on how this impacts your care experience at the UNM Health Sciences Center Security level. This information is crucial for everyone involved in ensuring patient safety remains uncompromised.

Understanding the Scope of the Incident

The incident was detected through our advanced threat detection systems, indicating unauthorized access to certain segments of our network infrastructure. While the investigation is ongoing and details are highly technical, we can confirm that the scope involves potential exfiltration or unauthorized viewing of protected health information (PHI). Our forensic teams have been working around the clock to map out the initial vector of entry—the pathway through which threat actors gained a foothold in our environment. This preliminary analysis suggests sophisticated techniques were employed, requiring deep packet inspection and endpoint detection and response (EDR) tools to identify malicious lateral movement.

We are treating this as a major security event that necessitates comprehensive containment protocols across multiple operational technology (OT) and information technology (IT) systems. The specific data types potentially involved include electronic medical records (EMRs), billing information, and research data associated with various UNM Health departments. To address concerns regarding potential Data Breach Notification requirements, we are rigorously adhering to all state and federal guidelines, including HIPAA mandates. Our collaboration with external cybersecurity firms ensures that our assessment of the compromised systems is thorough and forensically sound.

Initial Detection Vector and System Isolation

The initial detection was triggered by anomalous outbound network traffic patterns originating from a segment of our internal servers. Upon identifying this deviation, immediate isolation procedures were enacted. This involved logically segmenting the affected network zones to prevent further data egress or attacker persistence within other critical systems. This rapid containment action was crucial in limiting the potential blast radius of the attack.

Immediate Impact on Services and Patients

Due to the necessary security measures—specifically, taking certain connected systems offline for forensic imaging and remediation—some services have experienced intermittent disruptions or temporary unavailability. For our patients, this means that while emergency care pathways remain functional via established manual and backup procedures (ensuring continuity of life-sustaining treatment), non-critical digital services may be impacted.

We strongly advise patients to continue using primary communication channels for scheduling and billing inquiries, as these systems are being prioritized for restoration. For clinical staff, please refer immediately to department-specific downtime procedures provided by your unit manager. Our focus right now is on restoring full functionality in a verified secure state, rather than simply bringing services back online.

Operational Adjustments for Patient Care

To mitigate patient impact while the investigation proceeds, several operational adjustments are in place. Clinicians may be temporarily utilizing paper-based charting or accessing read-only views of necessary records from isolated, clean workstations. We appreciate your patience and cooperation as we transition back to digital systems piece by piece, ensuring each restored component meets stringent security validation benchmarks.

Steps Taken for Containment and Investigation

Our response strategy is multifaceted, involving technical containment, deep forensic investigation, and comprehensive communication management. The immediate priority following detection was threefold: Isolate & Assess, Eradicate & Remediate, and Restore & Harden.

Technical Containment Measures

Containment involved deploying network access control lists (NACLs) at key choke points to restrict communication between potentially compromised zones and core operational networks. Furthermore, we have initiated mandatory multi-factor authentication (MFA) re-enrollments across all remaining accessible systems for all personnel. This layered approach significantly hardens the perimeter against any residual threat actors.

Forensic Investigation Deep Dive

The forensic investigation utilizes memory analysis, disk imaging of affected endpoints, and network flow analysis to reconstruct attacker actions. We are specifically hunting for Indicators of Compromise (IOCs) such as persistent backdoors, rogue credentials, or command-and-control (C2) traffic signatures within our environment. This rigorous process underpins the entire effort to guarantee that when services return, they are truly clean.

What Affected Individuals Should Do Now (Action Items)

If you suspect your personal information has been compromised due to the recent security incident at UNM Health Sciences Center, immediate action is crucial to mitigate potential damage. The following steps are highly recommended and should be treated with urgency.

Securing Accounts and Credentials

• Change Passwords Immediately: Change passwords on any account that utilized credentials potentially stored or accessed by the compromised systems. Do not reuse old passwords; create strong, unique passphrases for every service.
• Enable Multi-Factor Authentication (MFA): If you have not already done so, enable MFA on all critical accounts (email, banking, healthcare portals). Hardware security keys (like YubiKeys) offer the strongest protection against phishing attacks.
• Review Account Activity: Log into your primary financial and email accounts and meticulously review recent activity logs for any unrecognized logins or transactions. Report anything suspicious to the service provider immediately.

Monitoring for Identity Theft

The risk of identity theft is elevated following a breach involving personal health information (PHI) and other identifiers.

• Credit Freezes: Consider placing a fraud alert or, preferably, a full credit freeze with the three major credit bureaus (Experian, Equifax, TransUnion). This prevents unauthorized accounts from being opened in your name.
• Review Statements Regularly: Check bank statements, credit card statements, and utility bills monthly for small, unusual charges that might indicate testing of stolen card numbers.

Phishing Vigilance

Cybercriminals often capitalize on the confusion following a major incident by launching targeted phishing campaigns.

• Verify Communication Channels: Never click links or download attachments from unsolicited emails, even if they appear to come from UNM Health Sciences Center or related departments. Always navigate directly to official websites using known URLs.
• Be Wary of Urgency Tactics: Phishing attempts frequently create a sense of panic ("Act immediately or your account will be locked!"). Legitimate entities rarely demand immediate action via unexpected email correspondence.

Future Preventative Measures and System Hardening

To enhance overall security posture, both individuals and organizational IT departments must adopt proactive hardening techniques. These measures move beyond simple reactive cleanup.

For End Users (Best Practices)

Adopting a "Zero Trust" mindset regarding digital assets is paramount:

1. Use Password Managers: Employ reputable, encrypted password managers (e.g., Bitwarden, 1Password). These tools generate and store complex, unique passwords, eliminating the risk associated with password reuse.
2. Implement Endpoint Detection and Response (EDR): For personal or work devices, ensure that robust antivirus/anti-malware solutions are installed, kept updated, and configured to run behavioral monitoring, not just signature matching.
3. Regular Patch Management: Keep all operating systems (Windows, macOS) and applications (browsers, Adobe Reader) updated immediately when patches for critical vulnerabilities are released.

For Organizations (System Hardening Guidance)

Organizations must treat this incident as a catalyst for comprehensive security architecture review:

Network Segmentation

Implement strict network segmentation to limit the "blast radius" of any future compromise. Critical systems (like patient record databases) should reside in isolated Virtual LANs (VLANs) accessible only through hardened jump boxes with mandatory MFA.

# Example concept: Restricting access via firewall rule set
iptables -A FORWARD -s 192.168.50.0/24 -d 10.0.1.5 --dport 3389 -j DROP # Block RDP from general network to critical server

Data Encryption At Rest and In Transit

Ensure that all PHI is encrypted both when stored (at rest, using AES-256 or better) and when transmitted (in transit, mandating TLS 1.3).

Official Resources and Ongoing Communication Channels

Relying on official, verified channels is the single most important step in managing information during a crisis.

Designated Information Hubs

• Primary Website: Always check the main, verified UNM Health Sciences Center website (check the URL carefully for typos or unusual domains).
• Official Hotline: Utilize the dedicated, published incident response hotline number provided by the institution. Do not use numbers found in unsolicited emails.

Communication Protocol Changes

Be aware that communication methods may change during an extended recovery period. The organization commits to providing updates via:

• Dedicated Status Page: A single, monitored status page will be established for real-time updates on system restoration timelines.
• Official Press Releases: All major findings or policy changes will be disseminated through formal press releases posted on the main institutional site.

We understand this information is stressful. Please treat all communications regarding this incident with extreme skepticism and verify details through at least two of the above official channels.

Frequently Asked Questions (FAQ)

Conclusion and Key Takeaways

The recent cybersecurity incident at UNM Health Sciences Center underscores a critical reality: digital resilience is no longer optional—it is fundamental to operational continuity, patient safety, and organizational trust. While the immediate threat has been managed by dedicated teams, this event serves as a powerful reminder that cyber threats are persistent, evolving, and multi-faceted.

The key takeaways from reviewing this situation are threefold: First, proactive monitoring and rapid incident response plans must be rigorously tested. Second, employee training on phishing and social engineering remains the most critical layer of defense. Third, a holistic approach encompassing technology stack hardening, policy enforcement, and human awareness is non-negotiable.

At hSECURITIES, we understand that every organization faces unique risk profiles. We do not offer one-size-fits-all solutions; we provide tailored strategies built on deep industry knowledge. If your facility or organization needs to assess its current security posture against the backdrop of evolving threats, we urge you to take immediate action.

Call to Action: Secure Your Digital Future

Do not wait for an incident to expose vulnerabilities. Contact hSECURITIES today to schedule a comprehensive technical advisory session or a full-scope security audit. Our expert team is ready to help you fortify your defenses, ensure HIPAA compliance, and maintain uninterrupted operations.

Protecting sensitive data requires expertise you can trust. Partner with hSECURITIES—your dedicated partner in robust cybersecurity defense.