{"id":"anmed-malware-patient-data-theft-jul-2026","category":"breach","status":"closed","title":"AnMed malware attack closes clinics and imaging services; patient information stolen","tldr":"Malware disrupted AnMed care across South Carolina and northeast Georgia, and criminals copied files containing possible patient information. AnMed says its network is restored; the data review continues. Watch for notices and verify unexpected messages.","summary":"AnMed disclosed a malware attack on 26 July that disrupted its network, phones and internet and forced clinics and imaging services to close. Ten facilities were still closed on 10 August. MyChart access returned on 12 August, and phone service and clinicians’ access to electronic records were restored by 21 August. AnMed subsequently confirmed that files had been copied from its network. Its notice says the network was securely restored and the cloud environment holding its main electronic health records was unaffected. Locally stored files could nevertheless contain patient identity details, Social Security numbers, diagnoses, treatment information, insurance details and financial account or payment card numbers. As checked through 3 November, AnMed’s public notice still describes an ongoing file review and promises direct notices afterwards; a final affected-person count and completion of notifications were not established. AnMed says it has no indication of verified identity theft resulting from the incident.","action":"AnMed patients should watch for a direct notice and can call 1-866-200-0970 with questions. Review account statements and credit reports, and consider a free credit freeze if identity details may be involved. Verify unexpected AnMed messages independently; do not open their attachments, disclose personal information or pay demands.","product":"AnMed health services and patient information","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["anmed","healthcare","malware","data-breach","identity-theft","united-states"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Notice of Data Security Event","url":"https://anmed.org/notice-data-security-eventb","by":"AnMed","date":""},{"kind":"advisory","title":"AnMed Systems Disruption Update 01","url":"https://anmed.org/about/news-media/news/anmed-systems-disruption","by":"AnMed","date":"2026-07-26"},{"kind":"advisory","title":"AnMed Systems Disruption Update 11","url":"https://anmed.org/about/news-media/news/anmed-systems-disruption-update-11","by":"AnMed","date":"2026-08-11"},{"kind":"news","title":"AnMed cyber incident: 10 facilities still closed 15 days later","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-cyber-incident-10-facilities-still-closed-15-days-later/","by":"Becker’s Hospital Review","date":"2026-08-10"},{"kind":"news","title":"AnMed confirms data theft in cyber incident","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-confirms-data-theft-in-cyber-incident/","by":"Becker’s Hospital Review","date":"2026-08-21"},{"kind":"news","title":"AnMed says stolen files may include SSNs, financial data","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-says-stolen-files-may-include-ssns-financial-data/","by":"Becker’s Hospital Review","date":"2026-08-27"}],"started":"2026-07-26","closed":"2026-08-27","created":"2026-11-03T20:46:40.997Z","updated":"2026-11-03T20:46:40.997Z","cve_notes":[],"timeline":[{"at":"2026-08-27","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Becker’s reported AnMed’s warning that copied files could contain identity, clinical, insurance and financial information. AnMed said its cloud-based electronic health records system was unaffected and direct patient notices would follow its file review.","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-says-stolen-files-may-include-ssns-financial-data/","by":"Becker’s Hospital Review","patch":null},{"at":"2026-08-21","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"AnMed confirmed criminals had taken information and began reviewing whose information required notification. It warned patients and employees against responding to unexpected messages or paying demands referencing AnMed information.","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-confirms-data-theft-in-cyber-incident/","by":"Becker’s Hospital Review","patch":null},{"at":"2026-08-12","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Patient access to MyChart was restored, according to Becker’s subsequent report. By 21 August, AnMed also confirmed restored phone service and clinicians’ ability to read and update electronic health records.","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-confirms-data-theft-in-cyber-incident/","by":"Becker’s Hospital Review","patch":null},{"at":"2026-08-11","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"AnMed removed unauthorised posts from its social media accounts and disabled access through the platform. It said the posts’ claims had not been verified.","url":"https://anmed.org/about/news-media/news/anmed-systems-disruption-update-11","by":"AnMed","patch":null},{"at":"2026-08-10","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Ten facilities remained closed, including imaging, laboratory and diagnostic services. Phone, internet and network disruption had continued since 26 July; whether patient information was affected remained unconfirmed.","url":"https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-cyber-incident-10-facilities-still-closed-15-days-later/","by":"Becker’s Hospital Review","patch":null},{"at":"2026-07-26","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"AnMed disclosed malware affecting its network. Medical Group offices and imaging services would close on 27 July while specialists and authorities helped investigate and restore systems.","url":"https://anmed.org/about/news-media/news/anmed-systems-disruption","by":"AnMed","patch":"na"}],"url":"https://hard.fyi/live/anmed-malware-patient-data-theft-jul-2026/","json":"https://hard.fyi/api/live?id=anmed-malware-patient-data-theft-jul-2026"}