A ransomware attack affecting the University of New Mexico Health Sciences Center has reportedly disrupted patient care, surgeries and academic operations after system outages hit parts of its digital infrastructure. While the incident took place in the United States, it is relevant for European businesses because it shows how cyberattacks can interrupt essential services, not just data access.

What happened

According to reporting cited in the source, the University of New Mexico Health Sciences Center disclosed a cyberattack that led to technology outages across parts of its organisation. The disruption affected healthcare delivery and academic activities, with patient care and surgeries among the reported impacts.

Based on the source, the incident has been described as a ransomware attack. At the time of reporting, the practical consequence was service disruption: systems were unavailable and operational workflows were affected.

Why it matters for European businesses

This case is a clear example of how ransomware can create immediate operational consequences. For many organisations, especially in healthcare and other regulated sectors, cyber incidents are no longer limited to stolen data or temporary inconvenience. They can interrupt appointments, transactions, production, logistics, customer support and core service delivery.

For European organisations, the business lesson is broader than the healthcare sector. Many companies now depend on interconnected cloud platforms, identity systems, booking tools, websites, ERP software and third-party applications. If attackers disrupt those systems, the impact can spread quickly across departments and external services.

The incident is also relevant in the context of European cybersecurity expectations. Organisations covered by sector-specific rules, GDPR obligations, or wider cybersecurity requirements such as NIS2 may need stronger risk management, incident handling, business continuity planning and supplier oversight. The exact legal obligations depend on the company, sector and country, but the operational expectation is increasingly clear: essential digital services must be resilient.

Who may be affected

• Healthcare providers and clinics that depend on digital patient records, scheduling, diagnostics and connected systems.
• Regulated businesses where outages can affect compliance, safety, customer service or essential operations.
• SMEs using centralised SaaS platforms for finance, sales, support or operations, where a single disruption can halt multiple workflows.
• IT and security teams responsible for backup integrity, identity protection, endpoint security and incident recovery.
• Business leaders who need to assess whether ransomware resilience is adequate at both technical and operational levels.

What companies should consider

• Review business continuity plans. Identify which systems are operationally critical and define manual fallback procedures for outages.
• Test backup and recovery processes. Backups are only useful if they can be restored quickly and reliably under incident conditions.
• Strengthen identity and access controls. Multi-factor authentication, least-privilege access and privileged account monitoring can reduce attacker movement.
• Segment critical systems. Network segmentation can help limit the spread of ransomware between departments or environments.
• Assess third-party dependencies. Map the vendors and cloud services that could become single points of failure during an attack.
• Prepare crisis communications. Customers, staff and partners need clear information when service disruptions affect operations.
• Run incident response exercises. Tabletop simulations can help management and technical teams practise decisions before a real disruption occurs.

Although this incident happened outside Europe, the underlying risk is highly relevant to European organisations building digital-first operations. The main takeaway is practical: ransomware resilience should be measured not only by cybersecurity controls, but also by how well the business can continue operating when key systems go offline.