On Monday, October 26, the University of New Mexico Health Sciences Center was hit by a cyberattack. As The Record reports, ambulances were sent to other hospitals in Albuquerque and Santa Fe for about two hours, outpatient surgeries and appointments were canceled for the rest of the day, and staff were told to unplug their desktops. This is the health system with the state’s only Level 1 trauma center, burn unit and children’s hospital. (Our news summary is here.)
A few days earlier, on October 21, Quest Diagnostics learned that someone had gotten into Quanum Lab Services Manager, the online system doctors’ offices use to order lab tests and look up results. Quest’s own notice says some patient data in that system was accessed, though it has not yet said what kind or how many people. (Our summary of that story is here.)
Two different incidents, two different kinds of harm. Put side by side, they show something most of us never think about until a letter arrives in the mail: our health care now runs on computers we will never see and cannot protect ourselves.
When the computers stop, care slows down
Hospitals used to keep paper charts as a matter of course. Today, records, scheduling, lab orders, imaging and pharmacy all depend on the network. When a hospital pulls the plug to stop an attack from spreading, it is doing the right thing, but the cost lands on patients right away. A diverted ambulance means a longer ride. A canceled surgery means another week of waiting.
UNM appears to have moved quickly. According to The HIPAA Journal, the diversion ran from 12:30 to 2:30 p.m., critical systems were restored early Tuesday, and clinics reopened that day. UNM Health told the Albuquerque Journal that the attack reached some end-user devices but not its core systems or servers. Anyone who has run servers knows that a fast shutdown is a plan someone wrote and practiced long before the bad day.
Your records live in places you never chose
The Quest case is quieter but touches more people. Most patients have never heard of Quanum LSM. You did not sign up for it. Your doctor’s office did, because that is how it sends your blood work to the lab and gets the results back. Every referral, lab test and insurance claim copies a little of your information into another company’s system.
That is not a reason to avoid care. It is a reason to keep an eye on the paperwork. Quest says it has contained the incident and restored the system, and that it will notify affected patients and offer credit and identity monitoring once the investigation is done. Until then, nobody outside the company knows whose records were involved.
The scam that follows the breach
Both organizations made the same warning, and I think it is the most useful part of this whole story. After a breach makes the news, scammers send emails, texts and calls pretending to be the hospital, the lab, or even the attackers. They offer refunds, “compensation” or account checks. UNM Health warned that those responsible may try “false offers of payments or compensation.” Quest also urges people to verify any lab-related message before acting on it.
The breach itself is out of your hands. The follow-up phishing is the part you can stop.
What we do not know
UNM has not said what kind of attack it was. A new ransomware group called BYOD has claimed it and says it compromised 36,000 machines and stole data on patients, students and employees. None of that has been confirmed, and The Register points out that a group claiming an attack does not prove it carried it out. UNM says it has made no concessions to the hackers and is waiting on a forensic review, with the FBI involved, to learn whether patient data was taken.
For Quest, we do not know how many patients are affected, which data was accessed, how the intruder got in, or how long the access lasted. As of this writing, no group has publicly claimed it.
What you can do
- Do not click breach-related links. If you get a message about either incident, go to the organization’s website yourself or call a number you already have. Never pay or share personal details because a message says your data was stolen.
- Read your Explanation of Benefits statements. The FTC’s guide to medical identity theft lists the warning signs, starting with bills for care or tests you never received.
- Check your credit reports. Unfamiliar accounts or medical debts you do not recognize are worth disputing early.
- Open the real notification letter carefully. If Quest or UNM writes to you, follow its instructions and sign up for any monitoring it offers.
- Keep a short paper list. Your medications, allergies and doctors’ phone numbers on one page will help if a clinic’s systems are down on the day you need care.
- Brush up on the basics. Strong passwords, multifactor authentication and spotting phishing are the everyday defenses; ransomwear.org collects how-to guides on each.
We cannot secure the servers that hold our medical records. We can watch our own paperwork, and we can refuse to be the second victim when the scam emails start.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
