The University of New Mexico Health System told people not to show up.

Albuquerque’s main hospital started diverting patients. More than 30 clinics canceled appointments. The public statement stopped at a cybersecurity issue, which is the kind of phrase that sounds finished in a press briefing and unfinished in a SOC. Your board hears a control failure. Patients hear a closed door.

Cybersecurity Failures Hit the Waiting Room

Shared services make the blast radius honest. Registration, imaging, pharmacy, labs, and the charting system often hang off one identity store, one virtualization cluster, and one stale runbook. You can keep a healthy firewall and still lose the day’s clinic schedule. The UNM Health System result is the ending every hospital tabletop files under unlikely.

Divert means the city is told your building is closed for business even if the lights still work.

Ambulances do not wait for your war room.

Incident response in a health system is a bed-management problem with a ticket number attached. Threat detection that never pages the people who own divert status is theater. The clinical command center will move patients on a rumor of downtime. Beat the rumor with facts: which systems are down, which sites can still chart, which pharmacies can still dispense, and when the next decision lands.

You will get asked if this is ransomware. You may not know yet. The divert call cannot wait for attribution. UNM made the correct public move. Don’t come here. That sentence also admits the digital front door and the physical one now fail together. Patients will remember the closed clinics longer than they will remember your severity rating.

Executives who still treat the EHR as an IT application pay for that belief in canceled oncology visits and diverted trauma. Clinic staff will try to work around a dark screen until someone in charge says stop. Give them a stop condition in writing before the outage writes it for you. Shared scheduling and a shared revenue cycle will close clinics that never touched the broken server. That is how you get 30 closures from one core outage.

Patch Queues Keep Growing Overnight

The same cycle brought Apple patches for 304 vulnerabilities. SANS says the volume matches recent drops. Treat it as load. Imaging carts, badge panels, clinic kiosks, and forgotten jump boxes absorb that queue slowly. Slow is how a weekday becomes a diversion.

Cloudflare described a different production surprise. A configuration mismatch in a hosted model path exposed KV cache pages across requests. Isolation that looked like a platform guarantee was a setting. You discover that class of bug live. Health systems get the same discovery with a worse audience and a thinner public statement.

Security hardening loses to the calendar until someone cannot check in. Defense in depth that stops at the data center edge leaves the downtime playbook on a file share you cannot open. Brute-force noise against a remote access gateway is a familiar pattern. A failed identity store sitting next to a failed EHR is the pattern that empties waiting rooms. Threat-protection dashboards can stay green in one pane and useless in the other if they never map to divert criteria.

Cyber security spending that cannot keep a clinic open is a budget line, not a control.

Diversion Plans Need Technical Triggers

Treat divert as a monitored condition. Tie technical health to clinical operations with steps that still work when the fancy console is dark.

Do this week, without a named actor or a tidy CVE:

• Write a one-page divert trigger that names the systems whose loss means patients stay home, the person who can call it, and the radio or out-of-band path used to reach EMS and clinic managers.
• Prove you can chart, prescribe, and register on downtime procedures for four hours at the busiest site. Paper nobody has touched since 2019 does not count.
• Inventory every path that authenticates clinicians, including VPN, SSO, MFA, badge, and local break-glass. Disable stale remote access. Rotate break-glass passwords and store them off the same cluster as the EHR.
• Keep an incident bridge that survives directory failure. If the call starts in the same identity system as the charting system, you will lose both at once.

Run a quarterly divert tabletop that starts from EHR unreachable rather than a ransom note on a screen. Time the first public instruction, the first ambulance redirect, and the first clinic cancellation. If those clocks live only in the CISO’s head, you will invent them on the worst morning of the year.

Store break-glass credentials off the same cluster as the charting system and test them. Patch SLAs for clinical endpoints should match the ones you already claim for internet-facing apps. Imaging workstations and clinic kiosks are production. Treat them that way before the next 300-fix drop lands on a weekend.

Sources

• Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
• Apple Patches for October 2026
• Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang