AnMed has confirmed that cybercriminals obtained information from the Upstate South Carolina health system during the cybersecurity incident that disrupted its network beginning July 26.[4]
The announcement marks an important change. AnMed initially described a malware-related network disruption and said it was investigating the scope.[1] On August 21, the health system said its investigation had progressed far enough to confirm information theft, while the specific data and affected individuals remained under review.[4][5]
AnMed CEO William Kenley also apologized publicly. WYFF quoted Kenley saying, “I recognize the concern, frustration and disruption the incident has caused, and I’m deeply sorry.”[6] AnMed also published a 2-minute, 38-second video statement from Kenley on its official YouTube channel.[8]
Watch AnMed CEO William Kenley’s update
The official AnMed video below addresses the attack, ongoing restoration work, the confirmation that cybercriminals obtained information, and the health system’s continuing review of what information and people may be affected.[8] It is a company statement—not independent proof of the final breach scope or threat-actor claims.
What AnMed has confirmed
AnMed’s current official position is narrow but consequential:
- Cybercriminals obtained information from AnMed.[4][5]
- AnMed is reviewing what information was involved and identifying people who may require notification.[4]
- Affected individuals will be notified directly after the review.[4][5]
- AnMed says it will provide appropriate resources based on the information involved.[4]
- Phone service, read-and-write access to electronic health records, and patient access to MyChart had been restored by the August 21 update, while teams continued restoring additional systems and services.[4]
AnMed has not publicly specified in the reviewed official materials how many people are affected, the confirmed data fields, the attacker’s initial access method, the access or exfiltration window, whether files were encrypted, whether a ransom was demanded or paid, or when individual notices will begin.[4][5]
That uncertainty is important. “Information was obtained” confirms a breach of confidentiality, but it does not establish that every AnMed patient or employee was affected—or that every category claimed by the attacker was actually stolen.
How the incident unfolded
July 26: malware disrupts the network
AnMed’s first notice said malware was affecting its network. The health system brought in third-party cybersecurity specialists and coordinated with state and federal authorities.[1]
The disruption immediately affected care operations. AnMed Medical Group offices and imaging services were scheduled to close July 27, elective-procedure patients were to be contacted, and decisions about transfers, diversions, and operations were made under patient-safety procedures.[1]
Secondary healthcare reporting said 83 of AnMed’s 106 facilities initially closed, while urgent care, Kids Care, integrated therapy, laboratories, emergency care, and other essential services continued under downtime procedures.[7] That figure comes from reporting—not AnMed’s latest confirmation—and should be treated as historical operational context.
July 31: support and investigations expand
AnMed said federal, state, and third-party investigations were ongoing and created expanded patient support for questions about appointments, prescriptions, and care.[2]
August 11–12: hackers make public claims; access begins returning
A group calling itself The Gentlemen claimed responsibility and alleged that it had exfiltrated about 6 terabytes of highly sensitive medical and identity data.[7] The group also allegedly used unauthorized access to AnMed’s Facebook presence to pressure the health system.[7]
Those details remain threat-actor allegations, not verified breach scope. AnMed said the attackers’ public descriptions were too general to determine what was actually affected or whose information was involved, and it refused to rely on those claims instead of its independent review.[4]
By August 12, AnMed said care teams could again view and update electronic health records, phone lines had returned, and patients with active MyChart accounts and mobile numbers on file could regain access through a verification code.[3]
August 21: information theft confirmed
AnMed’s fourteenth update confirmed that cybercriminals obtained information. The health system said the review was resource-intensive because it required analysis and validation before notifications could be sent.[4]
The confirmation does not validate the attacker’s claimed data volume or list of data categories. It establishes that information left AnMed’s control; the verified scope remains pending.[4]
Why patients and employees should be alert now
AnMed warned that those responsible may publish information, contact patients or employees, or make additional public claims.[4]
The most immediate risk is social engineering. A criminal who references AnMed, a real appointment, medical terminology, or a leaked detail can make a fraudulent message look convincing. The goal may be to obtain passwords, Social Security numbers, financial information, verification codes, or payment.[5]
AnMed’s official instructions are direct:
- Do not respond to or engage with an unexpected sender claiming to have AnMed information.[4][5]
- Do not click links or open attachments.[4][5]
- Do not provide passwords, Social Security numbers, financial details, or verification codes.[5]
- Do not make a payment.[4][5]
- Report direct or personal threats to local law enforcement.[4][5]
- Use
go.anmed.org/latest-updatesfor verified information.[4][5]
An unexpected message from an unknown sender is not an official breach notice. AnMed says it will contact affected people directly after determining whose information was involved.[5]
Practical steps for AnMed patients and employees
1. Verify through a channel you initiate
Do not use a phone number, link, QR code, or email address supplied in a suspicious message. Open AnMed’s website independently or use a phone number already saved from a trusted statement or prior medical paperwork.
2. Protect your email and MyChart accounts
Use a unique password for each account and enable multifactor authentication where offered. Never share a one-time verification code with someone who contacts you. AnMed’s restoration instructions said the MyChart text code is for identity verification and that users do not need to click a link or provide additional personal information.[3]
3. Watch financial and identity activity
Review bank, credit-card, insurance, and explanation-of-benefits statements for unfamiliar transactions or care. If AnMed later confirms exposure of Social Security numbers or financial identifiers, affected people should consider a fraud alert or credit freeze through the three major credit bureaus.
4. Be cautious with medical-information scams
A scammer may claim to know a diagnosis, appointment, provider, or balance. Do not assume that familiarity proves legitimacy. Call the provider or AnMed billing office using a verified number.
5. Preserve evidence without engaging
Take screenshots, record the sender address or phone number, note the time, and preserve voicemail. Do not reply to test whether the sender is real. Send evidence only through a verified reporting channel or to law enforcement when appropriate.
6. Do not delay emergency care
AnMed’s current FAQ says emergency patients should call 911 and that its emergency department is caring for emergency patients.[5] Cybersecurity uncertainty should not keep someone from seeking urgent medical help.
What remains unknown
At the reporting cutoff, AnMed’s official public materials did not provide:
- a confirmed victim count;
- confirmed exposed data types;
- a confirmed access or exfiltration period;
- the initial intrusion vector;
- confirmation that The Gentlemen was responsible;
- verification of the claimed 6-terabyte volume;
- a ransom amount or payment decision;
- a schedule for individual notices;
- the exact protective services that will be offered.[4][5]
Those gaps should be updated—not guessed—when AnMed completes its review, sends individual notices, files regulator notifications, or releases a more detailed incident report.
The bottom line
This is now a confirmed information-security breach, not only an operational outage.[4] But the affected population and confirmed data remain unresolved.[4][5]
AnMed patients and employees should not panic or assume that every record was exposed. They should be highly skeptical of unsolicited messages, use only independently verified contact channels, protect account credentials and verification codes, and watch for AnMed’s direct notification.[4][5]
Editorial boundary: Threat-actor attribution, the claimed 6-terabyte volume, and the attacker’s list of alleged data categories remain unverified allegations. This article does not reproduce stolen data, link to a leak site, or identify individual patients.
Sources
- AnMed systems disruption update 1
AnMed is currently experiencing a cybersecurity disruption involving malware that is impacting our network.
AnMed Medical Group offices will be closed Monday, July 27.
- AnMed systems disruption update 6
Federal, state and third-party investigations remain ongoing.
- AnMed systems disruption update 13
The investigation into the incident remains ongoing, and AnMed will share additional information as it becomes available.
- AnMed confirms information theft and issues guidance
It has confirmed cybercriminals obtained information from AnMed, and we are conducting a thorough review to determine what information was involved and identify the individuals who may require notification.
Anyone who receives an unexpected communication claiming to involve AnMed information should not respond, click links, open attachments, provide personal information or make a payment.
Phone service, read-and-write access to electronic health records and patient access to MyChart have been restored.
- AnMed current incident updates and FAQ
The investigation has confirmed cybercriminals obtained information from AnMed. The detailed review to determine the specific information involved and the individuals who may be affected is continuing.
Do not provide passwords, Social Security numbers, financial information or verification codes.
- WYFF report with CEO apology
Kenley stated that investigators are working to determine what information was taken and who may be affected.
I recognize the concern, frustration and disruption the incident has caused, and I'm deeply sorry.
- HIPAA Journal AnMed ransomware timeline and claim
AnMed has not disclosed the name of the group behind the attack, but a threat group called The Gentlemen claimed responsibility.
AnMed, formerly AnMed Health, a nonprofit health system serving patients in upstate South Carolina and Northeast Georgia, has been forced to temporarily close 83 of its 106 facilities while it deals with cyberattack-related disruption to its IT systems.
- AnMed CEO Addresses Cybersecurity Attack (official AnMed YouTube channel)
The investigation has now confirmed that cyber criminals did obtain some information from AnMed.
The review is detailed and ongoing, but as soon as we have more information about it, we will share those details with you.