When University of New Mexico Health systems went down on Monday, thousands of patients, doctors, and staff members suddenly found themselves operating without the digital infrastructure most modern hospitals depend on entirely. Systems came back online, life went on, and the story disappeared from headlines almost as quickly as it arrived.
But here’s what bothers me: we’re not asking the right questions about what this attack actually reveals.
The Speed of Recovery Deserves Scrutiny
One thing that jumps out immediately is how fast UNM got back up and running. The attack happened Monday. Systems were restored. The hospital issued a statement. Done.
That speed is either genuinely impressive or deeply concerning, and I’m not entirely sure which.
On one hand, it suggests UNM has solid backup systems, regular recovery drills, and maybe even a competent security team that knew exactly how to respond. That’s the generous interpretation. On the other hand, a genuinely sophisticated attack—one designed to do real damage rather than just create chaos—might not be visible in the immediate aftermath. Some of the most damaging breaches take weeks or months to detect fully.
The real question is: did UNM recover quickly because the attack was contained, or did they recover quickly without fully understanding what happened? Those are very different scenarios with very different implications for patient data security.
What We Don’t Know About Patient Data
Healthcare systems are treasure troves of information. Name, address, social security number, insurance details, full medical history—it’s all there, neatly organized and digitized. For criminals, it’s worth far more than credit card numbers.
After an attack like this, the urgent questions should be:
- Was patient data actually accessed, or just the systems disrupted?
- If data was accessed, how much? How many patient records?
- Which data was compromised—just demographics or full medical histories?
- Has UNM confirmed their backups weren’t also infected?
- What’s their timeline for notifying affected patients, if needed?
These answers matter enormously. A ransomware attack that encrypts files but doesn’t steal data is fundamentally different from one where attackers downloaded patient records before demanding payment. Yet we often don’t get clear public answers to these questions, and that’s a problem.
Healthcare providers have legal obligations to notify patients about data breaches under HIPAA, but those notifications can take weeks or months. The public statement that “systems are back online” doesn’t tell you whether your medical information is now in the hands of criminals.
The Broader Pattern Nobody Talks About
This isn’t a one-off incident. Healthcare facilities get attacked constantly. Ransomware groups specifically target hospitals because they know administrators face brutal pressure: pay up quickly, or people might die while trying to function without electronic records.
It’s extortion with a scalpel. The attackers understand their leverage perfectly.
What strikes me is how little we discuss the systemic failures that make these attacks possible in the first place. We treat each incident as isolated—focus on the immediate response, then move on. But the pattern is unmistakable: hospitals are under-resourced for cybersecurity, running outdated systems they can’t afford to replace, and staffed with IT teams stretched impossibly thin.
UNM isn’t unique. It’s normal. That’s the real story.
Every hospital administrator I’ve ever talked to knows their security is inadequate. Many run critical systems on infrastructure that’s ten or fifteen years old because newer systems cost millions and budgets don’t support that investment. They patch when they can, they do what they can with what they have, and they hope they don’t get hit.
Some of them get hit anyway.
What Happens Next Matters More Than What Happened
The real measure of how seriously UNM takes this isn’t that they recovered quickly. It’s what they do in the months that follow. Do they invest in genuine infrastructure upgrades? Do they hire more security staff? Do they conduct honest third-party audits and share results with patients? Do they implement better monitoring and detection systems?
Or do they dust themselves off and hope it doesn’t happen again?
We rarely follow up on these stories because they don’t have the drama of the initial attack. But the follow-up is where you find out whether anything actually changed.
Source: UNM Health systems come back online after Monday’s cyber attack
Chris Sullivan
Natalie Foster
Emma Clarke