Analyst assessment
AnMed experienced a ransomware incident beginning July 26, 2026, when malware disrupted its network and affected patient care across the health system’s South Carolina and Georgia footprint. AnMed’s initial notice said cybersecurity specialists and state and federal authorities were assisting with response and restoration.
AnMed’s Aug. 27 data-security notice says a computer virus locked access to files on its network and that files on certain systems were copied without permission. A confidential source working inside AnMed shared a photograph of a ransom demand displayed on a hospital computer, together with victim-specific access to a private negotiation server identified by the source as Interlock. The demand imposed a 72-hour deadline and threatened publication. Taken together, the confirmed file locking and ransom-demand evidence establish ransomware involvement.
The notice says AnMed’s electronic health records were primarily stored in a separate cloud environment that was not affected. It says some patient-care files may have been stored locally and may include names, contact and demographic details, dates of birth, Social Security numbers, government identifiers, clinical information, insurance information, financial account numbers and payment card numbers. Those are possible contents under review, not confirmed categories in every copied file.
Attribution assessment
Attribution remains disputed. Victim-specific access to the negotiation server supports medium-confidence attribution to Interlock. Amazon threat intelligence has documented Interlock’s use of organization identifiers and private Tor negotiation chats, features consistent with the AnMed evidence.
The Gentlemen separately listed AnMed in a public leak index Aug. 9. Gentlemen-branded messages then appeared through AnMed’s compromised social-media presence Aug. 11, claiming 6 terabytes of exfiltration and highly sensitive medical and identifying information. AnMed confirmed the unauthorized posts but did not validate the actor, volume or claimed categories.
AnMed’s finding that files were copied is consistent with both operations’ extortion narratives but does not resolve who was responsible. No public evidence establishes a relationship between Interlock and The Gentlemen or explains the conflicting attribution signals.
Operational significance
The incident disrupted health care delivery across AnMed’s regional network. Numerous outpatient, imaging and specialty locations closed or operated with limitations, procedures were delayed, some patients were diverted and staff used paper or other downtime workflows while phones, internet access, computers, electronic records and MyChart were unavailable. Emergency departments and selected urgent-care, laboratory and therapy services remained available.
Recovery occurred in stages. AnMed said Aug. 11 that care teams had regained full read/write access to electronic health records. Direct office and department phone service resumed Aug. 12, and patients with active accounts and mobile numbers on file regained access to MyChart, although not all portal features were available.
Current status
The operational incident is resolved. AnMed’s Sept. 14 restoration statement said normal operations had resumed across all hospitals, physician practices and other facilities. MyChart scheduling, care-team communications, health-information access, appointment reminders and other functions had returned. Teams were contacting patients to reschedule postponed care. Sept. 14 is the documented whole-service restoration date; the exact earlier completion time is not established. The Aug. 27 notice had described secure network restoration, a narrower finding than the later all-services announcement.
Aug. 21 remains the latest dated observation of operational limitations, including unavailable MyChart functions, imaging rescheduling, printed laboratory orders and the Fant Street laboratory closure. The Sept. 14 announcement closes those service-recovery questions rather than establishing a new outage.
The HHS Office for Civil Rights public breach table lists AnMed Health’s Aug. 27 submission as a network-server hacking/IT incident affecting 501 individuals. This is the reported figure in the table, not an established final total: AnMed’s public notice still says its copied-file review and identification of patients requiring direct notices are ongoing. That review does not by itself establish continuing service disruption.
Confidence and uncertainty
Confidence is high that malicious activity caused material disruption because AnMed confirmed the virus, network impairment and service changes. Ransomware is confirmed by the combination of AnMed’s file-locking finding and the ransom demand with victim-specific negotiation access. Interlock attribution confidence remains medium because AnMed and authorities have not named an actor and the Gentlemen claim remains material contrary evidence.
File copying is confirmed. The copied-file contents and affected-person count remain under review. AnMed says the cloud-hosted electronic health record environment was unaffected, but locally stored patient-care files may contain sensitive identifying, clinical, insurance and financial information.
Analytic gaps
The public record does not establish the initial access vector, malware build, compromised account or host, intrusion start, dwell time, file-locking implementation, affected backups or exact completion time before the Sept. 14 full-restoration announcement. It also does not establish the copied-data volume, confirmed data categories, final affected-person count; the relationship, if any, between Interlock and The Gentlemen; the validity of the claimed 6-terabyte volume; the demand amount; the negotiation outcome; payment; or public data release.
