[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFPBx9TwEV7FKVg3L53nwIksJHCeeqg7AK72Y4bpE--U":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"0ef614a3-ff1f-4e92-bcce-21dc2afc400f","Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack","day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-cent-1bd3a9","University hospitals once again accepting patients after initial ambulance diversion, but recovery to continue in phases","The University of New Mexico has canceled classes for a second day following a cybersecurity event that targeted its Health Sciences Center. The attack forced the shutdown of systems, cancellation of appointments, and diversion of ambulances from UNM Health hospitals. While hospital operations are returning to normal, the university is still working on recovery, and non-essential staff are advised to stay home.","University of New Mexico cancels classes for second day due to cybersecurity event impacting Health Sciences Center.","https:\u002F\u002Fwww.theregister.com\u002Fcyber-crime\u002F2026\u002F10\u002F27\u002Fday-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack\u002F5305690","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5238831&width=800","2026-10-27T16:15:00+00:00","2026-10-27T17:00:22.272066+00:00",7,[17,20,22,25],{"name":18,"type":19},"BYOD","threat_actor",{"name":21,"type":19},"EndZone",{"name":23,"type":24},"Oracle databases","product",{"name":26,"type":27},"Active Directory","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":28,"icon":30,"name":31,"slug":32},null,"Breaches","breaches",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":40,"value":48,"context":49},"PHP2Shell","Mentioned in a related article snippet as being under attack.",[23],{"controls":52,"vendors":137},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","rapid7-mdr","Rapid7 MDR","https:\u002F\u002Fwww.rapid7.com\u002Fservices\u002Fmanaged-detection-and-response-mdr\u002F","Managed detection and response, 24\u002F7.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-mdr","Truesec MDR","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fmanaged-detection-and-response","Managed detection and response from Truesec's security operations centre.",{"slug":83,"name":84,"problem":85,"products":86},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"slug":112,"name":113,"problem":114,"products":115},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":133,"product_name":134,"url":135,"description":136},"truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"unm-health-sciences-cyberattack-forces-two-days-of-class-cancellations-and-ambulance-diversions","UNM Health Sciences Cyberattack Forces Two Days of Class Cancellations and Ambulance Diversions","A cyberattack targeting the University of New Mexico's Health Sciences Center caused cascading disruptions, including canceled classes, suspended appointments, and ambulance diversions — hallmarks of inadequate network segmentation between administrative, academic, and clinical systems. When a single attack can simultaneously disable university operations and divert emergency medical care, it signals that critical healthcare infrastructure was not sufficiently isolated from broader institutional networks. The multi-day recovery period further suggests incident response plans were either absent, untested, or insufficiently resourced for a healthcare environment. This incident matters because lives can be endangered when hospital operations are disrupted, making healthcare cybersecurity a patient safety issue, not merely an IT concern.",[143,144,145,146,147,148,149],"CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","GDPR Article 32",{"GDPR Article 32":151,"NIS2 Article 21(2)(b)":152,"MITRE ATT&CK T1566: Phishing":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"CIS Control 17: Incident Response Management":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"As a healthcare institution handling patient data, UNM is obligated to implement appropriate technical and organizational measures to ensure resilience of systems — the shutdown of health systems and appointment cancellations indicates this obligation was not fully met.","NIS2 mandates incident handling capabilities for essential service operators, including healthcare; the ambulance diversion and multi-day outage demonstrate that UNM's incident handling capabilities were insufficient to protect essential health services.","Phishing remains the most common initial access vector in healthcare cyberattacks; if this incident originated via phishing, robust email security controls and staff training could have blocked the initial compromise entirely.","Timely identification and remediation of exploitable vulnerabilities across interconnected university and health system networks could have prevented attackers from gaining the foothold needed to cause system-wide shutdowns.","The multi-day disruption to both university and hospital operations suggests the incident response plan lacked tested procedures for healthcare continuity, which this control requires organizations to develop, maintain, and exercise.","A structured technical vulnerability management program would require the university to inventory, assess, and remediate vulnerabilities in health-critical systems before attackers could exploit them to disrupt patient care.","Proper access control and network segmentation between academic and clinical systems would have limited the attacker's ability to move laterally and disrupt hospital operations from a university-side entry point."]