Small Business Cybersecurity: Lessons From the UNM Incident

A cybersecurity incident can interrupt the services your customers depend on before investigators establish what happened. The University of New Mexico Health System's October 2026 disruption illustrates that operational exposure. For an SMB CEO, the relevant issue is how your organization would continue serving customers while essential systems are unavailable or cannot yet be trusted.

The lessons extend beyond healthcare: identify critical functions, validate recovery capabilities, and establish decision-making authority before a disruption. Harbor Technology Group approaches small business cybersecurity as an ongoing business discipline connecting technical protection with executive oversight. Applying that approach requires evidence that your people, processes, and technology can operate together under pressure.

Key Takeaways: Cyber Incident Readiness for SMB CEOs

• The UNM incident illustrates how cybersecurity disruption can interrupt essential services before investigators establish the cause or scope.
• Prioritize critical business functions and document safe fallback procedures so your team can sustain essential services during system outages.
• Test restoration against business requirements; completed backups alone do not demonstrate that your organization can recover within acceptable timeframes.
• Define executive authority, communication responsibilities, and external response contacts before an incident creates urgent decisions across your organization.
• Harbor Technology Group supports incident readiness through response planning, tabletop exercises, and ongoing improvements aligned with your business environment.

What the UNM Incident Demonstrates About Operational Disruption

The UNM incident demonstrates how a cyber event can disrupt essential services across an interconnected organization. In its October 26, 2026 reporting on UNM, the Associated Press described diverted ambulances and canceled appointments at more than 30 clinics. Other health systems coordinated to accept additional patients, and UNM reported a phased resumption of operations later that day.

AP also reported employees' accounts of computer messages claiming data theft. Those claims did not establish a confirmed breach scope, and the report did not identify the root cause. The business lesson does not require speculation about ransomware, an entry point, or failed controls.

Your organization should prepare to make operational decisions while technical facts remain incomplete. Service interruption alone can create missed commitments, rescheduling costs, and customer uncertainty, even before any data exposure is confirmed.

Business Continuity Starts With Critical Business Functions

Business continuity begins by identifying the services your organization must sustain and the dependencies supporting them. A manufacturer may prioritize production scheduling and shipping; a professional services firm may prioritize client records and communications. The relevant unit of planning is the business function, supported by its systems, people, data, and suppliers.

For each function, document an accountable owner, acceptable interruption, and safe alternative procedure. Your business continuity plan should explain how employees receive instructions when normal communication channels fail and how transactions recorded during an outage will later be reconciled.

Test alternatives before relying on them. Manual processing must preserve privacy, authorization, and record accuracy; bypassing controls to maintain service can introduce additional risk. An activity that cannot continue safely should have a documented suspension and customer-notification procedure.

Recovery Readiness Requires More Than Successful Backups

Recovery readiness means demonstrating that critical services can be restored within business-defined limits. A successful backup report confirms only part of that capability. Your team must also establish that the required data, applications, configurations, and access services can be restored together in a trustworthy environment.

Define a recovery time objective, the target time to restore a service, and a recovery point objective, the amount of data loss your business can tolerate. Rank restoration priorities by business impact and dependencies, rather than assuming every system can return simultaneously.

A risk assessment can help connect technical gaps to business consequences. Require restoration tests that record elapsed time, missing dependencies, and corrective actions. UNM's phased resumption illustrates the operational importance of returning services in stages; AP's reporting does not establish the organization's backup design or recovery procedures.

Why Does Incident Response Require Executive Decision-Making?

Incident response requires executive decisions because containment can affect revenue, contractual commitments, and customer access. Technical responders need established authority to isolate affected systems, while leadership needs clear escalation thresholds for business interruption, external support, and stakeholder communications.

Your response plan should name an incident leader and alternates, distinguish technical responsibilities from business decisions, and identify legal counsel, insurance contacts, and response providers. Preserve accessible copies of the plan and contact list outside systems that could become unavailable.

Harbor Technology Group's incident readiness services help define response roles, communication protocols, and scenario-specific procedures. Establish who approves customer updates and when legal review is needed. Communications should distinguish confirmed facts from investigation findings still in progress and avoid unsupported assurances about data safety or restoration timing.

External Dependencies Belong in Continuity Planning

Continuity planning must account for external dependencies because your disruption can affect other organizations and their outages can interrupt your operations. AP reported that neighboring healthcare providers coordinated with UNM and accepted additional patients. The incident illustrates operational interdependence; it does not establish that a vendor caused the event.

For your business, map dependencies such as payment processing, hosted applications, logistics, and managed IT services. Your risk management strategy should identify which relationships lack a practical alternative and which contractual commitments require timely communication during disruption.

Verify escalation contacts, incident-notification arrangements, and the assumptions behind a provider's recovery commitments. An alternative supplier or service is useful only if capacity, access, and security requirements have been evaluated. Do not assume another organization can absorb your workload simply because it offers a similar service.

Leadership Exercises Turn Plans Into Operational Readiness

Leadership exercises test whether your response plan supports decisions under realistic constraints. A tabletop exercise is a facilitated discussion of a simulated incident, allowing participants to examine responsibilities and choices without intentionally disrupting production systems.

Use a scenario relevant to your business: customer records are inaccessible, email is unavailable, and a major client requests an explanation. Ask who declares the incident, which services can continue safely, who contacts counsel, and how employees receive verified instructions.

The CISA small-business guidance recommends CEO participation in exercises and regular testing of backups. Harbor Technology Group uses tabletop exercises to identify gaps in coordination and response procedures. Record each finding, assign an owner and deadline, and retest the revised process. Do not infer from UNM's response that any particular exercise or preparation occurred.

Building Resilience Through Ongoing Executive Oversight

Operational resilience requires ongoing executive oversight as technology, staffing, and business dependencies change. Your security program should combine preventive controls, detection, response, and recovery, with clear evidence that each layer remains appropriate to your business.

Use regular leadership reviews to examine restoration results, exercise findings, unresolved risks, and changes to critical suppliers. A documented governance structure connects those findings to accountable owners, funding decisions, and accepted risks. A growing organization without dedicated security leadership can also consider vCISO advisory support to coordinate that work.

The lasting lesson from UNM is the importance of preparing for interrupted service while facts remain uncertain. Identify the functions your customers depend on, test how they recover, and ensure your leadership team can make informed decisions. Revisit that capability as part of running the business, rather than treating readiness as a completed project.