UNM Health Outage: Ransomware, Downtime and DDoS Extortion

At 11 a.m. on October 26, the University of New Mexico Health System detected something wrong on its network. By lunchtime the state's only Level 1 trauma center had stopped accepting ambulances, more than 30 clinics had cancelled appointments, and medical students were sent home. Systems were restored by Monday afternoon and operations returned to normal the next day, but the episode is a reminder that downtime is a clinical metric, not an IT one. Think of it as a self-inflicted DDoS on care delivery: the packets were replaced by encrypted files, and the outage was measured in diverted ambulances.

A Two-Hour Window With Statewide Consequences

The published timeline is tight: detection around 11:00, containment, an Emergency Operations Center activated, outside responders engaged, state and federal law enforcement notified. From 12:30 to 14:30 the system paused new admissions while teams isolated the network, and outpatient surgeries plus appointments were suspended for the rest of the day. UNM says the threat touched some end-user devices but not core servers — a distinction that means little to a patient turned away at the door. EHR downtime forces paper fallbacks, paper fallbacks slow registration, and slow registration backs up the emergency department. That is how a workstation-level incident becomes a regional capacity problem, with Presbyterian and Lovelace absorbing the overflow.

Initial Access: Phishing, VPN Gateways and the Usual Suspects

Healthcare intrusions rarely start with anything exotic. The reliable entry points remain a phishing attachment that lands on a help-desk workstation, an exposed VPN or RDP gateway with credentials reused from a previous breach, and an unpatched edge appliance carrying a public cve. From there the affiliate workflow is familiar: harvest credentials, fatigue or relay MFA, move laterally to backup infrastructure, stage and exfiltrate data, then encrypt. The dwell time between initial access and detonation is often measured in days, which is exactly the window where network segmentation and offline backups earn their budget. UNM's decision to isolate first and investigate second is the correct sequence; too many victims still chase the encryption instead of the persistence.

Encryption Plus Packet Pressure: The DDoS Extortion Playbook

Encryption alone no longer guarantees a payout, so affiliates increasingly pair it with DDoS extortion. While negotiators stall, a rented ip stresser or booter — often a ddos-for-hire subscription costing a few hundred dollars — points traffic at the victim's public edge. The goal is not to break the encryption but to remove the last shred of availability, and for a hospital that means phones, patient portals and triage systems. The toolkit is commodity: SYN flood, ACK flood and plain TCP handshake flood to exhaust connection tables, UDP amplification through DNS, NTP, SSDP and CLDAP reflectors, HTTP/2 Rapid Reset to collapse upstream connections, plus TLS flood and HTTP GET or POST flood against anything still answering. Layer 7 campaigns add browser emulation, JA3 fingerprint rotation and CAPTCHA bypass — the same toolkit sold in every cloudflare bypass guide — while a modest botnet can sustain Slowloris indefinitely.

Volumetric attacks are absorbed by anycast and scrubbing, which is why operators who buy ddos protection often still lose the application layer. A UDP flood at 400 Gbps makes headlines; a well-shaped HTTP flood that mimics real sessions does actual damage. That asymmetry is the whole business model of the stresser economy, and it is why we keep saying that capacity without layer 7 mitigation is just expensive bandwidth.

The Takeaway

UNM Health got lucky: fast containment, no confirmed data theft, and a regional partner network that absorbed the load. The next hospital may not. Ransomware crews have learned that downtime plus DDoS extortion creates urgency that a single encrypted file share never could, and the barrier to entry keeps falling. Defenders should stress test the same path attackers use — from the VPN concentrator to the public edge — before someone else does it for them. If you want to see how your own perimeter behaves under pressure, our free stress test is one click away at /contact; the records speak for themselves.