Menu
Healthcare worker using a computer, illustrating hospital cyberattack recovery.

Cyberattack Diverts Ambulances, Plus 3 Stories

, , , , , ,

A cyber incident at the University of New Mexico Health Sciences Center forced the state’s only Level 1 trauma center to divert ambulances on Monday. That disruption lasted about two hours, but it’s a useful reminder that hospital cyberattack recovery is measured in patients, appointments, and clinical decisions, not just whether a server comes back online.

A cyber incident diverted ambulances from New Mexico’s only Level 1 trauma center

UNM Health detected what it called a cybersecurity threat around 11 a.m. on October 26. The response affected end-user devices, including desktop computers, and employees were told to unplug workstations and disconnect from Wi-Fi. Ambulances were temporarily sent elsewhere. More than 30 clinics canceled appointments, and outpatient surgeries and procedures were paused.

This wasn’t a small inconvenience hiding behind the word “outage.” UNM Hospital includes New Mexico’s only Level 1 trauma center, its only dedicated children’s hospital, and the state’s only burn center. When those services lose normal digital tools, neighboring hospitals, dispatchers, clinicians, and patients all absorb the consequences.

By October 27, UNM said critical electronic systems were back online, ambulance traffic had returned to normal, and clinics had reopened. The health system said some end-user devices were affected but that its core systems and servers weren’t penetrated. The Associated Press also reported that employees saw an attacker’s claim to have stolen patient, student, and staff data. UNM hasn’t confirmed that claim, so it remains an allegation, not an established breach fact. The FBI is assisting.

The practical lesson is bigger than “have backups,” important as that is. A hospital, repair shop, retailer, or any organization that delivers a physical service needs a downtime plan for the period before restoration: Who answers phones? Which work can continue on paper? Which systems come back first? How do staff communicate when the usual network is unavailable? And when was that plan last tested with the people who must actually use it?

There’s no general action for patients right now beyond using UNM’s official channels for rescheduling and watching for a formal notice if the investigation later confirms exposed data. For operators, the useful question is whether your recovery plan restores the business process, not merely the machine.

Backups & recovery

Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.

A July Magento fix now has active exploitation behind it

CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on October 27. That changes the risk calculation for stores running Adobe Commerce or Magento Open Source. Adobe fixed the flaw in July, when it said it wasn’t aware of exploitation. There’s now evidence attackers are using it.

The vulnerability can let an unauthenticated attacker upload a dangerous file and escalate privileges after a user interacts with a malicious URL or compromised page. In plain language, an attacker may be able to turn a seemingly ordinary visit into control they shouldn’t have. Adobe rates it critical, with a CVSS score of 9.6.

If you operate one of these stores, install the July 2026 security build for your supported 2.4.x branch now. Then check for compromise. Review unexpected uploaded files, administrator accounts, active sessions, and web logs. Patching closes the known hole; it doesn’t remove an attacker who arrived before the patch. That’s the same distinction I made in the patch isn’t the entire incident plan.

If a hosting company or developer manages the store, ask for the exact installed version and what evidence they checked after upgrading. “Automatic updates are enabled” is useful, but it isn’t an answer to either question.

Business IT goes well beyond the website

Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.

The ad auction can be the surveillance system

Real-time bidding is the machinery that auctions an ad impression while a page or app loads. The uncomfortable detail is that the auction can expose an IP address, approximate or precise location, network provider, device identifiers, and other metadata to bidders that never win and never show an ad.

TrendAI researchers say a bidder they tracked as Shadow-Earth-79 became the top winning bidder on Starlink traffic in 105 countries, winning roughly 13 percent of observed auctions, about five times the typical rate in the dataset. Reuters, citing people familiar with the matter, linked that bidder to Discover-Tech. Citizen Lab and Confiant separately named the company in research about ad technology used for surveillance and spyware delivery. Discover-Tech and SpaceX didn’t respond to Reuters’ requests for comment.

That attribution is still based on research and source reporting, and the public evidence has limits. The underlying mechanism is less ambiguous. An ad auction can reveal a Starlink user’s network and location signals without Starlink itself being hacked. Calling this a “Starlink breach” would be cleaner for a headline and worse for understanding what happened.

Most people don’t need to panic. People with a serious surveillance risk should treat advertising infrastructure as part of their threat model. A hardened browser, reputable content blocking, resetting mobile advertising identifiers, and separating sensitive activity can reduce exposure. A VPN may hide the home or satellite provider’s IP address from ad bidders, but it shifts trust to the VPN operator and doesn’t erase every other identifier. Privacy tools help; they don’t repeal the business model.

The rules around technology matter too

Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.

Older iPhones and iPads got a targeted-exploit fix

Apple released security updates across multiple supported branches on October 26, including iOS and iPadOS 27.2, 26.7.2, and 18.7.11, along with macOS and Safari updates. One CoreGraphics flaw can allow a malicious file to trigger arbitrary code execution. Apple says it may have been exploited in a sophisticated attack against specific targeted people using iOS versions before iOS 27.

That wording doesn’t mean every iPhone is under active attack. It does mean keeping an older supported device on its current branch is a reasonable choice only if you install the branch’s security updates. Check Settings, General, Software Update. Businesses using mobile-device management should verify that devices on all allowed branches actually received the fix, not simply assume the newest operating-system branch covers them.

The encouraging part is that Apple issued fixes for more than one generation. The less exciting, more useful takeaway is familiar: an update policy has to include the machines and phones people are really using.

Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.

Sources and further reading

Photo by Andrea Piacquadio on Pexels.

Related Posts

Leave a Reply

Only people in my network can comment.