The two-hour diversion: a tabletop inject from UNM Health's cyber event

On Monday, Oct. 26, UNM Health diverted ambulance traffic to other area health systems from 12:30 to 2:30 p.m. while its security teams worked to protect the network. According to the UNM Health Sciences Center newsroom, IT security teams began containment around 11 a.m. after identifying a threat, leadership activated an Emergency Operations Center, and outpatient surgeries and appointments were suspended for the rest of the day.

That is roughly ninety minutes between the start of containment and a decision to send ambulances somewhere else. I want to use that window as a tabletop inject, because the diversion decision is one that most hospital exercises skip and most hospitals will eventually face.

What UNM has said, and what it has not

The facts I am working from come from UNM's own updates. Its assessment was that the event affected some end-user devices but did not penetrate core systems or servers. Teams worked with external partners to secure the network and notified state and federal law enforcement. At 2:30 p.m. UNM Health began bringing systems back online in phases, as it was safe to do so. By the afternoon of Oct. 27, it said all hospitals were fully open, ambulance traffic was back to normal, and clinics had resumed. By Oct. 28 it reported that clinical operations across all UNM Health facilities were fully functional.

UNM also says the incident remains under criminal investigation, which limits what it can share. I am not going to guess at the cause or at who was behind it. The cause is not what the exercise needs. The exercise needs the decision.

One detail from the updates is worth noticing. The first public notice, posted at 2:30 p.m. on Oct. 26, said all ambulance traffic was being diverted and told patients not to come to UNM Health facilities that day. The 6:08 p.m. update described the same window as a period when UNM Health "temporarily limited its acceptance of new patients" and thanked health systems in Albuquerque and Santa Fe for making sure patients had a safe place to receive care. Both are accurate. They are also different messages to different audiences, written hours apart, by people working through an active event. That is something a tabletop can practice too.

Why diversion belongs in the exercise

Most cyber tabletops I see stop at the IT decisions: isolate this segment, reset these credentials, call the insurer, call outside counsel. Those matter. But in a hospital, the decision with the most direct effect on patients is often clinical and operational, and it gets made by people who are not in the security channel.

Diversion is a good example. It moves risk off your campus and onto neighbors, onto EMS crews, and onto patients who now ride farther. It also buys time, protects patients from a care environment that may be degraded, and lets clinicians work without guessing which systems they can trust. Neither choice is free. That is exactly the kind of decision a tabletop is for, because the tradeoffs are clearer at a conference table than at 12:15 p.m. on a Monday.

The inject

Here is how I would write it. Keep it short, and release information in stages so the room has to decide with incomplete facts.

Inject 1, 11:00 a.m. Security reports a confirmed threat affecting a number of staff workstations. Containment has started. Some clinical staff are reporting that they cannot log in on shared workstations. Core clinical servers appear unaffected, but the team cannot yet say that with confidence.

Inject 2, 11:45 a.m. Containment requires taking more end-user devices offline. The emergency department charge nurse reports that staff are moving to downtime procedures. The lab and imaging teams ask whether results interfaces are reliable.

Inject 3, 12:15 p.m. EMS dispatch calls to ask whether you are accepting ambulances. Two units are en route.

Then stop and ask the room to decide.

Questions for the room

These are the discussion prompts I would put on the facilitator sheet. None of them has one right answer. The goal is to find out whether your organization already has answers, and whether the people who need them know where they are.

Who has the authority to divert? Name the role, not the person. Then name the backup for nights and weekends. If the answer is "the CEO" or "whoever is on call," ask how that person gets reached and briefed in under fifteen minutes.

What triggers the Emergency Operations Center? UNM activated one. Does your plan say a cyber event can activate the EOC on its own, or does it only list fires, floods, and mass casualty events? If cyber is not on the list, the room will lose time arguing about whether this counts.

What information does the decision-maker need, and who provides it? I would expect at least these:

1. Which clinical systems are down, degraded, or unverified, in plain language.
2. Whether downtime procedures are working in the emergency department, lab, imaging, and pharmacy.
3. Staffing on the floor right now, and whether staff are trained on paper workflows.
4. Current emergency department census and acuity.
5. How long security expects containment to take, stated as a range with honest uncertainty.

Notice that only one item on that list comes from the security team. The other four come from clinical and operations leaders. If your security lead is the only person briefing the incident commander, the diversion decision will be made on a partial picture.

Who calls the neighbors? Diversion works only if the receiving hospitals and EMS know about it quickly. UNM thanked health systems in Albuquerque and Santa Fe. Your exercise should name which hospitals you would call, who makes the call, and what you tell them.

What is the exit criterion? UNM resumed at 2:30 p.m., in phases. Ask the room what has to be true before you accept ambulances again. If nobody can say, diversion tends to last longer than it should, or end before it is safe.

What do you say publicly, and to whom? Patients, staff, students if you have them, EMS, and the press need different messages. The two UNM updates are a useful example to read aloud. Ask the room which version they would post first and why.

Running it

Keep the scenario free of attack detail. The exercise is about clinical and operational decisions under uncertainty, so the technical story only needs to be believable and incomplete. Put clinical leaders, operations, communications, and security at the same table. Time each decision. Write down every question the room could not answer, and assign each one an owner before people leave.

If you want a starting structure, the free AI tabletop exercise kit from Cyber Defense Tactics has a ready-to-run scenario with a facilitator guide, and the diversion inject above drops into it as an extra decision point. For the vendor side of the same kind of event, I wrote about what a hospital will ask before it reconnects your integration.

Here is the question I would leave on the whiteboard. If your security team called at 11 a.m. today, who in your hospital would decide by 12:30 whether the next ambulance comes to you?