AnMed malware attack closes clinics and imaging services; patient information stolen
Malware disrupted AnMed care across South Carolina and northeast Georgia, and criminals copied files containing possible patient information. AnMed says its network is restored; the data review continues. Watch for notices and verify unexpected messages.
AnMed patients should watch for a direct notice and can call 1-866-200-0970 with questions. Review account statements and credit reports, and consider a free credit freeze if identity details may be involved. Verify unexpected AnMed messages independently; do not open their attachments, disclose personal information or pay demands.
What’s happening
AnMed disclosed a malware attack on 26 July that disrupted its network, phones and internet and forced clinics and imaging services to close. Ten facilities were still closed on 10 August. MyChart access returned on 12 August, and phone service and clinicians’ access to electronic records were restored by 21 August. AnMed subsequently confirmed that files had been copied from its network. Its notice says the network was securely restored and the cloud environment holding its main electronic health records was unaffected. Locally stored files could nevertheless contain patient identity details, Social Security numbers, diagnoses, treatment information, insurance details and financial account or payment card numbers. As checked through 3 November, AnMed’s public notice still describes an ongoing file review and promises direct notices afterwards; a final affected-person count and completion of notifications were not established. AnMed says it has no indication of verified identity theft resulting from the incident.
- What
- Breach
- Affects
- AnMed health services and patient information
- Fixed in
- Nothing to patch
- Since
- 26 July 2026
- Closed
- 27 Aug 2026
Timeline
- Update
Becker’s reported AnMed’s warning that copied files could contain identity, clinical, insurance and financial information. AnMed said its cloud-based electronic health records system was unaffected and direct patient notices would follow its file review.
- Update
AnMed confirmed criminals had taken information and began reviewing whose information required notification. It warned patients and employees against responding to unexpected messages or paying demands referencing AnMed information.
- Update
Patient access to MyChart was restored, according to Becker’s subsequent report. By 21 August, AnMed also confirmed restored phone service and clinicians’ ability to read and update electronic health records.
- Update
AnMed removed unauthorised posts from its social media accounts and disabled access through the platform. It said the posts’ claims had not been verified.
- Update
Ten facilities remained closed, including imaging, laboratory and diagnostic services. Phone, internet and network disruption had continued since 26 July; whether patient information was affected remained unconfirmed.
- Made publicNothing to patch
AnMed disclosed malware affecting its network. Medical Group offices and imaging services would close on 27 July while specialists and authorities helped investigate and restore systems.
Sources
- Notice of Data Security EventAnMed
- AnMed Systems Disruption Update 01AnMed · 26 July 2026
- AnMed Systems Disruption Update 11AnMed · 11 Aug 2026
- AnMed cyber incident: 10 facilities still closed 15 days laterBecker’s Hospital Review · 10 Aug 2026
- AnMed confirms data theft in cyber incidentBecker’s Hospital Review · 21 Aug 2026
- AnMed says stolen files may include SSNs, financial dataBecker’s Hospital Review · 27 Aug 2026