UNM Health Ransomware Attack: Ambulance Diversions Expose Critical Gaps in Healthcare Cyber Resilience

The University of New Mexico Health System (UNM Health) has been forced to divert ambulances and operate under downtime procedures after a cyberattack rendered critical electronic systems inaccessible. While the full scope of the intrusion is still being investigated, early reporting indicates an encryption-based incident — consistent with ransomware — that has disrupted access to electronic health records and other clinical systems.

For those of us who have led incident response engagements in hospital environments, this is the scenario we train for and dread in equal measure. When a health system loses access to its EHR, the consequences cascade immediately: clinicians revert to paper charting, lab and imaging results are delayed, medication reconciliation becomes error-prone, and emergency departments are forced to divert incoming ambulances to other facilities. Patient safety is directly compromised. This is not a theoretical risk — it is happening right now in Albuquerque.

Healthcare organizations remain the most targeted vertical for ransomware operators. The combination of legacy infrastructure, 24/7 operational requirements, interconnected third-party systems, and the life-or-death pressure to restore services makes hospitals exceptionally attractive to threat actors who understand that downtime tolerance is measured in minutes, not days. The UNM Health incident is the latest in a sustained campaign against the healthcare sector, and every CISO and SOC leader in this space should be treating it as a warning shot.

This post breaks down the attack from a defender's perspective: the likely attack chain, what detection opportunities exist at each stage, how to hunt for precursors in your own environment, and the concrete steps healthcare organizations must take to build resilience against encryption-based attacks.

Technical Analysis

Understanding the Attack Pattern

While UNM Health has not publicly attributed the attack to a specific ransomware group or disclosed the initial access vector, encryption-based incidents in healthcare environments follow a well-documented playbook. Based on our experience responding to dozens of similar incidents, the typical attack chain unfolds as follows:

Initial Access. Ransomware affiliates most commonly gain entry through one of several vectors: phishing emails delivering credential harvesters or initial access malware, exploitation of exposed remote services (RDP, VPN appliances, Citrix gateways), compromised third-party/vendor credentials, or purchased access from initial access brokers (IABs). Healthcare environments are particularly vulnerable to VPN and remote access exploitation because of the sheer number of remote users — clinicians, administrative staff, third-party vendors, and connected medical device management systems.

Persistence and Privilege Escalation. Once inside, operators establish persistence through scheduled tasks, new service creation, registry run keys, or legitimate remote management tools (RMM) like AnyDesk, ScreenConnect, or Splashtop deployed as unauthorized software. Credential theft using tools like Mimikatz or LSASS memory dumping follows, enabling lateral movement as a privileged user.

Discovery and Lateral Movement. Attackers enumerate the environment using built-in Windows utilities — net.exe, nltest.exe, AdFind, and PowerShell cmdlets — to map domain trusts, identify domain controllers, locate backup infrastructure, and discover high-value targets like EHR database servers and file shares. Lateral movement typically occurs via SMB, RDP, WMI, or PsExec-style service execution.

Defense Evasion and Impact Preparation. Before detonating encryption, sophisticated operators disable or uninstall endpoint security agents, delete Volume Shadow Copies to inhibit recovery, and stop critical services. The command vssadmin delete shadows /all /quiet or its PowerShell/WMI equivalents are near-universal precursors to ransomware encryption.

Encryption and Extortion. The ransomware payload encrypts files across servers and workstations, drops ransom notes, and in many cases, exfiltrates data first for double-extortion leverage. In healthcare, this means protected health information (PHI) may be exfiltrated, creating HIPAA breach notification obligations in addition to the operational crisis.

Why Healthcare Environments Are Uniquely Vulnerable

Healthcare networks present a fundamentally different defensive challenge than enterprise IT:

Legacy systems: Many clinical applications run on outdated operating systems that cannot support modern EDR agents or may break if patched aggressively. Medical devices often run embedded Windows XP, Windows 7, or legacy Linux kernels with no upgrade path.
Flat network architecture: Hospital networks historically prioritize availability over segmentation. Clinical workstations, IoT/IoMT devices, administrative systems, and guest networks often share broadcast domains or lack proper VLAN isolation.
Vendor access sprawl: Healthcare organizations maintain remote access connections for dozens or hundreds of third-party vendors — EHR support, medical device manufacturers, pharmaceutical systems, HVAC contractors. Each of these is a potential entry point.
Patch window constraints: Systems supporting patient care cannot be taken offline for maintenance without careful clinical coordination. This creates extended patch lag windows that attackers exploit.
Understaffed security teams: Many community hospitals and academic medical centers operate with security teams that are a fraction of the size needed to defend their attack surface.

Exploitation Status

No specific CVE has been disclosed in connection with the UNM Health incident at the time of writing. The attack is consistent with active ransomware operations targeting the healthcare sector, which remain at historically elevated levels. Healthcare was the most-breached sector for the 14th consecutive year according to the most recent industry data, and encryption-based attacks against hospitals show no signs of abating.

Detection and Response

The following detection content targets the behaviors most commonly observed in healthcare ransomware incidents. These are not theoretical — they reflect the TTPs we have seen across dozens of healthcare IR engagements. Tune them to your environment, but do not disable them if they fire. Investigate every alert.

Sigma Rules

The following Sigma rules target three critical phases of a ransomware attack chain: shadow copy deletion (pre-encryption), mass file encryption behavior, and unauthorized remote access tool deployment (persistence/lateral movement).

YAML

---
title: Volume Shadow Copy Deletion via vssadmin or WMI
description: Detects deletion of Volume Shadow Copies, a near-universal precursor to ransomware encryption. Attackers delete shadow copies to prevent rapid file recovery without paying the ransom.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.hipaajournal.com/university-new-mexico-health-system-cyberattack/
author: Security Arsenal
date: 2026/03/09
status: experimental
level: high
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin.exe delete shadows'
  selection_wmi:
    CommandLine|contains:
      - 'wmic shadowcopy delete'
      - 'wmic.exe shadowcopy delete'
  selection_powershell:
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
      - '.Delete()'
    CommandLine|contains:
      - 'Win32_Shadowcopy'
  selection_diskshadow:
    CommandLine|contains:
      - 'diskshadow'
      - 'delete shadows'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup maintenance scripts (rare, verify with change management)
  - IT administrators performing storage reclamation
---
title: Suspicious File Rename Pattern Consistent with Mass Encryption
description: Detects high-volume file rename operations consistent with ransomware encryption behavior. Monitors for processes creating files with known ransomware-style extensions or high-entropy random extensions appended to existing files.
references:
  - https://attack.mitre.org/techniques/T1486/
  - https://www.hipaajournal.com/university-new-mexico-health-system-cyberattack/
author: Security Arsenal
date: 2026/03/09
status: experimental
level: critical
logsource:
  category: file_event
  product: windows
detection:
  selection_extension:
    TargetFilename|endswith:
      - '.encrypted'
      - '.locked'
      - '.crypto'
      - '.enc'
      - '.crypt'
      - '.lockbit'
      - '.blackcat'
      - '.alphv'
  selection_ransom_note:
    TargetFilename|contains:
      - 'README_FOR_DECRYPT'
      - 'HOW_TO_DECRYPT'
      - 'RECOVER_FILES'
      - 'RESTORE_FILES'
      - 'DECRYPT_INSTRUCTION'
      - 'HOW_TO_RECOVER'
      - 'README.txt'
    Image|endswith:
      - '\rundll32.exe'
      - '\explorer.exe'
      - '\svchost.exe'
  condition: selection_extension or selection_ransom_note
falsepositives:
  - Legitimate file encryption tools (VeraCrypt, BitLocker management)
  - Application-specific file locking mechanisms
---
title: Unauthorized Remote Access Tool Installation
description: Detects installation or execution of remote access tools commonly abused by ransomware operators for persistence and lateral movement in healthcare environments. These tools bypass traditional network controls and blend with legitimate IT activity.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://www.hipaajournal.com/university-new-mexico-health-system-cyberattack/
author: Security Arsenal
date: 2026/03/09
status: experimental
level: high
logsource:
  category: process_creation
  product: windows
detection:
  selection_anydesk:
    Image|endswith: '\AnyDesk.exe'
  selection_screenconnect:
    Image|endswith: '\ScreenConnect.ClientService.exe'
  selection_splashtop:
    Image|endswith:
      - '\SRManager.exe'
      - '\SplashtopSOS.exe'
  selection_teamviewer:
    Image|endswith: '\TeamViewer_Service.exe'
  selection_tactical:
    Image|endswith:
      - '\tacticalrmm.exe'
      - '\meshagent.exe'
  selection_netexec:
    CommandLine|contains:
      - 'nxc smb'
      - 'crackmapexec'
      - 'netexec'
  condition: 1 of selection_*
falsepositives:
  - Authorized IT remote management tools — maintain an approved software inventory and alert on deviations
  - Managed service provider (MSP) tools — verify against known MSP software list

KQL Hunt Query (Microsoft Sentinel / Defender)

The following KQL query hunts for the combination of shadow copy deletion followed by suspicious process execution — a pattern strongly correlated with pre-encryption ransomware staging. Run this across your environment immediately, and consider setting it as a scheduled analytics rule with a 15-minute frequency.

KQL — Microsoft Sentinel / Defender

// Hunt for ransomware staging: shadow copy deletion + suspicious follow-on activity
// Time window: last 72 hours — extend as needed for historical hunting
let lookback = 72h;
// First, identify devices where shadow copies were deleted
let ShadowCopyDeletion = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any (
        "vssadmin delete shadows",
        "wmic shadowcopy delete",
        "diskshadow",
        "Win32_Shadowcopy"
    )
    | project ShadowDeleteTime=TimeGenerated, DeviceName, DeviceId,
              ShadowDeleteCommand=ProcessCommandLine,
              ShadowDeleteAccount=AccountName,
              ShadowDeleteProcess=ProcessName;
// Correlate with subsequent suspicious process execution on the same device
let SuspiciousFollowOn = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any (
        "net stop",
        "taskkill",
        "bcdedit",
        "wbadmin delete",
        "net user",
        "reg add",
        "sc create",
        "sc config"
    )
    | project FollowOnTime=TimeGenerated, DeviceName,
              FollowOnCommand=ProcessCommandLine,
              FollowOnProcess=ProcessName,
              FollowOnAccount=AccountName;
// Join: find devices where shadow deletion was followed by additional suspicious commands within 2 hours
ShadowCopyDeletion
| join kind=inner SuspiciousFollowOn on DeviceName
| where FollowOnTime > ShadowDeleteTime
| where FollowOnTime < ShadowDeleteTime + 2h
| project DeviceName, ShadowDeleteTime, ShadowDeleteCommand, ShadowDeleteAccount,
          FollowOnTime, FollowOnCommand, FollowOnProcess, FollowOnAccount
| sort by ShadowDeleteTime asc;
// Secondary hunt: check for mass file renames (encryption indicator) on affected devices
DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where ActionType == "FileRenamed"
| where FileName endswith ".txt" or FileName endswith ".pdf" or FileName endswith ".docx"
      or FileName endswith ".xlsx" or FileName endswith ".doc" or FileName endswith ".jpg"
| summarize RenameCount = count() by DeviceName, bin(TimeGenerated, 5m)
| where RenameCount > 50
| join kind=inner (ShadowCopyDeletion | distinct DeviceName) on DeviceName
| project DeviceName, TimeGenerated, RenameCount
| sort by RenameCount desc;

Velociraptor VQL Hunt Artifact

The following VQL artifact collects evidence of ransomware staging activity across endpoints: recent process execution matching known TTPs, suspicious network connections, and evidence of shadow copy deletion. Deploy this as a hunt across your fleet.

VQL — Velociraptor

-- Ransomware Staging Detection Hunt
-- Targets: shadow copy deletion, suspicious service creation, unauthorized RMM tools,
-- and lateral movement artifacts
-- Deploy as a hunt across all Windows endpoints

LET ProcessArtifacts = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(vssadmin.*delete.*shadow|wmic.*shadowcopy.*delete|diskshadow|bcdedit.*recoveryenabled.*no|wbadmin.*delete.*catalog|net.*stop.*backup|net.*stop.*veeam|net.*stop.*sql)'
   OR Name =~ '(?i)(anydesk|screenconnect|splashtop|teamviewer|meshagent|tacticalrmm)'

LET SuspiciousServices = SELECT Name, DisplayName, PathName, StartType, Status, Description
FROM wmi_query(namespace='root/cimv2', query='SELECT Name, DisplayName, PathName, StartType, Status, Description FROM Win32_Service WHERE StartType = "Auto"')
WHERE PathName =~ '(?i)(temp|appdata|programdata|users.public|perflogs)'
   OR DisplayName =~ '(?i)(anydesk|screenconnect|splashtop|mesh)'

LET NetworkConnections = SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status = 'ESTABLISHED'
  AND RemotePort IN (443, 8443, 5938, 8040, 8041)
  AND Name =~ '(?i)(anydesk|screenconnect|splashtop|teamviewer|meshagent)'

SELECT 'Process Execution' AS ArtifactType,
       Pid AS PID,
       Name AS ProcessName,
       CommandLine AS CommandLine,
       Username AS Username,
       CreateTime AS Timestamp,
       '' AS RemoteAddress,
       '' AS ServicePath
FROM ProcessArtifacts
UNION ALL
SELECT 'Service Installation' AS ArtifactType,
       0 AS PID,
       Name AS ProcessName,
       DisplayName AS CommandLine,
       '' AS Username,
       '' AS Timestamp,
       '' AS RemoteAddress,
       PathName AS ServicePath
FROM SuspiciousServices
UNION ALL
SELECT 'Network Connection' AS ArtifactType,
       Pid AS PID,
       Name AS ProcessName,
       '' AS CommandLine,
       '' AS Username,
       '' AS Timestamp,
       RemoteAddress AS RemoteAddress,
       '' AS ServicePath
FROM NetworkConnections

Remediation and Hardening Script

The following PowerShell script performs critical verification and hardening steps relevant to ransomware defense. Run this on servers and workstations to assess current posture and apply immediate hardening. This is not a substitute for comprehensive remediation but provides rapid risk reduction.

PowerShell

# ============================================================
# Ransomware Resilience Assessment & Hardening Script
# Run as Administrator on Windows Servers and Workstations
# ============================================================

Write-Host "=== Ransomware Resilience Check ===" -ForegroundColor Cyan
Write-Host "Hostname: $env:COMPUTERNAME" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date)" -ForegroundColor Cyan
Write-Host ""

# --- 1. Check Volume Shadow Copy Status ---
Write-Host "[1] Checking Volume Shadow Copies..." -ForegroundColor Yellow
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Host "  [PASS] Shadow copies exist: $($shadows.Count) found" -ForegroundColor Green
    $shadows | ForEach-Object {
        Write-Host "    Volume: $($_.VolumeName) | Created: $($_.InstallDate)" -ForegroundColor Green
    }
} else {
    Write-Host "  [FAIL] NO shadow copies found — recovery capability is degraded" -ForegroundColor Red
    Write-Host "  ACTION: Enable shadow copies: vssadmin add shadowstorage /for=C: /on=C: /maxsize=10%" -ForegroundColor Red
}

# --- 2. Verify VSS Service is Running ---
Write-Host "[2] Checking VSS Service..." -ForegroundColor Yellow
$vss = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vss.Status -eq 'Running') {
    Write-Host "  [PASS] VSS service is running" -ForegroundColor Green
} else {
    Write-Host "  [WARN] VSS service status: $($vss.Status)" -ForegroundColor Yellow
}

# --- 3. Check for Unauthorized Remote Access Tools ---
Write-Host "[3] Scanning for remote access tools..." -ForegroundColor Yellow
$ratTools = @('AnyDesk', 'ScreenConnect', 'Splashtop', 'TeamViewer', 'MeshAgent', 'TacticalRMM', 'LogMeIn', 'GoToMyPC')
$foundRAT = $false
foreach ($tool in $ratTools) {
    $installed = Get-WmiObject -Class Win32_Product -ErrorAction SilentlyContinue |
                 Where-Object { $_.Name -like "*$tool*" }
    $running = Get-Process -Name "*$tool*" -ErrorAction SilentlyContinue
    $service = Get-Service -Name "*$tool*" -ErrorAction SilentlyContinue
    if ($installed -or $running -or $service) {
        Write-Host "  [ALERT] Found: $tool — Verify this is authorized IT software" -ForegroundColor Red
        $foundRAT = $true
    }
}
if (-not $foundRAT) {
    Write-Host "  [PASS] No unauthorized RAT tools detected" -ForegroundColor Green
}

# --- 4. Check SMBv1 Status (should be disabled) ---
Write-Host "[4] Checking SMBv1..." -ForegroundColor Yellow
$smbv1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($smbv1.State -eq 'Disabled') {
    Write-Host "  [PASS] SMBv1 is disabled" -ForegroundColor Green
} else {
    Write-Host "  [FAIL] SMBv1 is ENABLED — Disable immediately" -ForegroundColor Red
    Write-Host "  ACTION: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol" -ForegroundColor Red
}

# --- 5. Check Windows Defender / EDR Status ---
Write-Host "[5] Checking Defender status..." -ForegroundColor Yellow
$defender = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($defender) {
    if ($defender.RealTimeProtectionEnabled) {
        Write-Host "  [PASS] Real-time protection is enabled" -ForegroundColor Green
    } else {
        Write-Host "  [FAIL] Real-time protection is DISABLED" -ForegroundColor Red
    }
    if ($defender.AMRunningMode -ne 'Normal') {
        Write-Host "  [WARN] Defender mode: $($defender.AMRunningMode) — Third-party AV may be managing protection" -ForegroundColor Yellow
    }
    Write-Host "  Last signature update: $($defender.AntivirusSignatureLastUpdated)" -ForegroundColor Cyan
} else {
    Write-Host "  [WARN] Unable to query Defender status — verify EDR agent health" -ForegroundColor Yellow
}

# --- 6. Check for Suspicious Recently Created Services ---
Write-Host "[6] Checking for recently created suspicious services..." -ForegroundColor Yellow
$recentServices = Get-WmiObject Win32_Service |
    Where-Object { $_.PathName -match '(temp|appdata|programdata|users\.public|perflogs)' }
if ($recentServices) {
    Write-Host "  [ALERT] Suspicious services found:" -ForegroundColor Red
    $recentServices | ForEach-Object {
        Write-Host "    Name: $($_.Name) | Path: $($_.PathName)" -ForegroundColor Red
    }
} else {
    Write-Host "  [PASS] No suspicious service paths detected" -ForegroundColor Green
}

# --- 7. Check RDP Exposure ---
Write-Host "[7] Checking RDP configuration..." -ForegroundColor Yellow
$rdpEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -ErrorAction SilentlyContinue).fDenyTSConnections
if ($rdpEnabled -eq 0) {
    Write-Host "  [WARN] RDP is ENABLED on this system" -ForegroundColor Yellow
    $nla = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -ErrorAction SilentlyContinue).UserAuthentication
    if ($nla -eq 1) {
        Write-Host "  [PASS] Network Level Authentication (NLA) is enabled" -ForegroundColor Green
    } else {
        Write-Host "  [FAIL] NLA is DISABLED — Enable immediately to prevent unauthenticated RDP access" -ForegroundColor Red
    }
} else {
    Write-Host "  [PASS] RDP is disabled" -ForegroundColor Green
}

# --- 8. Audit Local Administrator Accounts ---
Write-Host "[8] Auditing local administrators..." -ForegroundColor Yellow
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
Write-Host "  Current local admins: $($admins.Count)" -ForegroundColor Cyan
$admins | ForEach-Object {
    Write-Host "    $($_.Name) ($($_.ObjectClass))" -ForegroundColor Cyan
}
if ($admins.Count -gt 4) {
    Write-Host "  [WARN] High number of local admins — Review and reduce" -ForegroundColor Yellow
}

Write-Host ""
Write-Host "=== Assessment Complete ===" -ForegroundColor Cyan
Write-Host "Review all FAIL and WARN items and remediate per incident response procedures." -ForegroundColor Cyan

Remediation

Immediate Actions for Healthcare Organizations

1. Validate Your Backup Integrity — Today. Not tomorrow. Pull a random backup set and attempt a full restore to an isolated environment. Verify that your backups are:

Stored offline or in an immutable format (air-gapped, object lock, or WORM storage)
Segmented from production credentials (separate service accounts, separate authentication domain)
Tested with documented recovery time objectives (RTO) that align with clinical downtime tolerance
Covering not just data, but system state, Active Directory, and application configurations

2. Implement Network Segmentation. If clinical workstations, medical devices, administrative systems, and guest networks share the same VLAN or can reach each other without restriction, you have a lateral movement superhighway. At minimum:

Isolate IoMT/medical devices into dedicated VLANs with strict ACLs permitting only required clinical communication
Segment administrative networks from clinical networks
Implement micro-segmentation for critical servers (EHR, PACS, pharmacy systems)
Block workstation-to-workstation SMB and RDP except for designated management subnets

3. Enforce Phishing-Resistant MFA Everywhere. Every remote access path — VPN, Citrix, RDP, cloud email, EHR portals — must require MFA. Prefer FIDO2/WebAuthn or certificate-based authentication over SMS or push-based MFA, which are susceptible to fatigue attacks and SIM swapping. Do not forget service accounts and third-party vendor connections.

4. Audit and Reduce Third-Party Access. Inventory every vendor with remote access to your network. Disable or expire accounts that are not actively needed. Implement just-in-time access for vendors that do require connectivity. Log and alert on all third-party authentication events.

5. Deploy or Validate EDR Coverage. Ensure endpoint detection and response agents are deployed on all servers and workstations, with particular attention to:

Domain controllers
Backup servers
EHR database and application servers
Jump boxes and management workstations
Clinical workstations that support EDR (work with your clinical engineering team for systems that cannot tolerate agents and implement compensating network-level controls)

6. Restrict and Monitor PowerShell and Scripting. Enable PowerShell logging (Script Block Logging, Module Logging, Transcription) via Group Policy. Implement AppLocker or Windows Defender Application Control (WDAC) to restrict unauthorized script execution. Block Office macros from executing from internet-sourced documents.

7. Harden Active Directory. Ransomware operators target AD for privilege escalation. Implement tiered administration, disable legacy authentication protocols (NTLMv1, basic auth), audit and reduce Domain Admin membership, enable Protected Users group for privileged accounts, and monitor for DCSync and Golden Ticket indicators.

8. Update Your Incident Response Plan. If your IR plan has not been exercised in the last 12 months, it is a document, not a capability. Conduct a tabletop exercise simulating a ransomware scenario that includes: ambulance diversion procedures, clinical downtime workflows, HIPAA breach notification decision trees, law enforcement engagement (FBI, CISA, HHS), cyber insurance notification requirements, and media/communications response.

HIPAA Regulatory Considerations

For healthcare organizations, a ransomware incident triggers multiple regulatory obligations:

HIPAA Breach Notification Rule: If PHI is encrypted (rendered unavailable) or exfiltrated, this constitutes a breach under HIPAA. Notification to HHS OCR, affected individuals, and potentially media outlets is required within 60 days for breaches affecting 500+ individuals.
HHS Cybersecurity Performance Goals: HHS published voluntary Cybersecurity Performance Goals (CPGs) specifically for healthcare. Align your program against these as a baseline.
State breach notification laws: New Mexico and most states have independent breach notification requirements that may impose shorter timelines than HIPAA.
Cyber insurance: Review your policy's notification requirements. Many policies require notification within 24-72 hours of discovering an incident. Failure to notify promptly can void coverage.

Building Long-Term Resilience

The UNM Health incident is not an anomaly — it is a pattern. Healthcare organizations that survive ransomware attacks with minimal patient impact share common characteristics: tested backups, segmented networks, practiced downtime procedures, and security teams empowered to act decisively. The organizations that suffer weeks of downtime, massive PHI breaches, and nine-figure recovery costs are the ones that treated cybersecurity as an IT cost center rather than a patient safety imperative.

If your security program has not been independently assessed against ransomware-specific TTPs in the past 12 months, that gap is your highest-priority action item. The threat actors are not waiting, and neither should you.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub