AnMed, a nonprofit health system based in Anderson, South Carolina, closed dozens of medical practices and imaging sites Monday after malware disrupted its network, while emergency departments and urgent care centers remained open.
The outage knocked out phone and internet service Sunday across the system’s locations in Upstate South Carolina and northeast Georgia. AnMed says it has 648 licensed beds, more than 60 physician practices and about 3,600 employees.
AnMed initially described the problem as a phone and internet outage affecting all locations. The system later said it was experiencing “a cybersecurity disruption involving malware that is impacting our network.” AnMed said outside cybersecurity specialists and state and federal authorities were assisting with the response.
AnMed closed its medical group offices and imaging services Monday. Patients with elective procedures scheduled for Monday were to be contacted directly by staff.
The system said all three emergency departments remained open, along with urgent care, pediatric urgent care, therapy and laboratory locations. Outpatient infusion services were limited.
An official with ambulance provider Medshore told Fox Carolina that patients were being diverted from AnMed to hospitals in Greenville. AnMed said decisions about procedures, transfers and diversions were being made “with patient safety as the guiding principle.”
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
Other hospitals have curtailed care during recent cyber disruptions. Signature Healthcare in Massachusetts diverted ambulances, shifted to paper records and paused some cancer and pharmacy services in April. Hampton Regional Medical Center in South Carolina reported losing access to patient records during a July 2025 cyber incident.
AnMed had not provided a timeline for full restoration or disclosed how many patients were affected or whether patient data was accessed or stolen. The system had not identified ransomware, a ransom demand or a threat actor, and DysruptionHub found no public claim of responsibility as of Monday. AnMed said it would release operating plans for the coming days as more information became available.
AnMed did not immediately respond to additional questions.
