Held Hostage in Public

Held Hostage in Public: Inside the AnMed Extortion Standoff

Kentrena Bohm

On Sunday, July 26, AnMed, a nonprofit health system serving upstate South Carolina and northeast Georgia, sustained a malware incident that knocked out phones, internet access, and IT systems across its network. By Monday, 83 of its 106 facilities were dark. Oncology and radiation services were closed. Imaging stopped. Elective procedures were canceled. Emergency departments, urgent care, general labs, and pediatric locations stayed open, falling back on the paper-and-pen methods hospitals used before electronic records.

One patient, relayed by a frontline clinician, described a hospital workstation displaying a ransom note: 72 hours to pay, or patient data would be leaked. A threat group calling itself The Gentlemen, a ransomware-as-a-service operation, has since claimed responsibility. The Gentlemen ranked as the third most active ransomware group in the second quarter of 2026, claiming 125 attacks, up from 83 the quarter before, the largest jump of any established group. Since emerging in 2025, the group has been tied to more than 787,400 breached records in confirmed attacks worldwide, along with 36 claimed attacks on healthcare organizations, eight of them confirmed.

Ransomware, Extortion, or Both?

The two terms describe different tactics. Classic ransomware is an availability attack: files get encrypted, operations stop, and the victim pays for a decryption key. Pure data extortion skips encryption; the attacker steals data and threatens to publish it. The Gentlemen, like most serious groups today, run “double extortion”: break in, steal sensitive data first, encrypt files on the way out, then threaten publication, creating two separate reasons to pay.

AnMed has never publicly used the word “ransomware,” describing the event only as “a cybersecurity disruption involving malware.” The ransom note described by the patient and separately confirmed by hospital staff speaking anonymously points to an encryption event. AnMed has confirmed data was taken. Whether systems were actually encrypted, or proactively taken offline to contain the intrusion, hasn’t been made public; either produces the same visible shutdown. The honest read is double extortion, consistent with the group’s known playbook, with the data theft confirmed and the encryption still unconfirmed.

What’s Happened Since

The closures dragged on for weeks. Ten days into the attack, 10 AnMed locations, including several outpatient imaging sites, were still closed. Care teams didn’t regain full read-and-write access to electronic health records until August 11, 16 days after the incident began.

The extortion moved to a public stage. Also on August 11, attackers hijacked AnMed’s Facebook page. The Gentlemen were reportedly unsatisfied with the pace of negotiation by then, suggesting a private channel had already been open before the public escalation. The posts claimed 6 terabytes of stolen data spanning the most sensitive categories a hospital holds: HIV status, suicide registries, sexual assault and rape victim records, mental health and abortion records, genetic data, Social Security numbers, dates of birth, and autopsy and police evidence. The message ended with “deletion on payment.” No proof was posted. AnMed said the claims had not been verified, removed the content, and disabled the compromised accounts.

AnMed confirmed the breach 26 days after the attack. On August 21, CEO William Kenley released a video statement confirming that cybercriminals had obtained some information from AnMed’s systems and apologized for the disruption. AnMed said the attackers’ claims were too general to rely on and that it would complete its own independent review before determining scope and notifying anyone.

Opportunists moved in behind the attackers. Patients reported direct contact soliciting payments. AnMed also warned that MyChart appointment reminders generated outside its internal systems might still arrive by text and that no one needed to confirm appointments electronically.

Formal notification hasn’t happened yet. AnMed says its review to determine which individuals require notification is still underway, and no notification letters appear to have gone out so far. Multiple plaintiffs’ firms are already soliciting current and former patients and employees for potential class actions.

Performance Analysis

Every critical incident is a performance test administered without notice. Five findings stand out.

The story went public before the response plan could, and AnMed never got ahead of it. The ransom message reached the public through a patient’s account to local news before AnMed had said anything about its nature. Sixteen days later, the attackers took over AnMed’s own Facebook page, a channel entirely separate from clinical systems. Crisis communication plans must assume zero lag between compromise and public awareness, on every channel the organization operates, not just the ones IT considers critical.

Degraded operations are still operations. AnMed kept emergency departments, labs, and urgent care running while entire service lines went dark for weeks. That’s the right objective under attack: continuity of care, not restoration of technology for its own sake. Paper charting and manual patient tracking are perishable skills. If they were last practiced in an annual compliance drill, they won’t hold up through a multi-week outage, and this one ran well past the “few days” most downtime plans assume.

Two clocks run at once, and the public only sees one. Twenty-six days until public confirmation looks like a delay, but the picture is likely incomplete. AnMed said from day one that it had engaged third-party cybersecurity specialists along with state and federal authorities, so forensics and required regulatory reporting were likely underway before the public knew anything. The Cyber Incident Reporting for Critical Infrastructure Act’s 72-hour clock is a private filing to CISA, not a public announcement, and there’s no public evidence AnMed missed it. HIPAA separately requires notifying affected individuals without unreasonable delay and no later than 60 days after discovery, which is a legal determination, not the attack date. A month of public silence can coexist with an organization on schedule internally: running forensics, handling an active threat actor, and preparing a defensible notification, all out of view. Public silence is not evidence of inaction.

Extortion pressure escalates when payment doesn’t come quickly. The shift from a ransom note on internal screens to a public Facebook takeover is a pressure escalation, not a new attack. Groups like The Gentlemen name the most damaging categories of data first because they’re the hardest for a healthcare system to shrug off publicly. Incident response plans need a playbook for this phase: what does the organization say when the attacker starts naming specific data categories to a public audience, and who has authority to respond in real time?

Secondary fraud is part of the incident, not an aftershock. Unsolicited payment requests and confusing appointment messages during the outage show that the attack surface extends to anyone who can plausibly impersonate the health system while it’s visibly compromised. This must be anticipated and treated as an active workstream from day one.

How These Attacks Actually Work

Incidents like this rarely start with something exotic. AnMed hasn’t disclosed how the attackers got in, but most breaches begin with something ordinary. A phishing email harvests a password. A convincing phone call to the IT help desk, known as vishing, talks an employee into resetting credentials or approving an MFA prompt. A remote-access account is left protected by nothing but a password. Attackers don’t need to break down the door when someone can be persuaded to open it.

The Gentlemen typically get in by brute-forcing credentials on web or VPN login panels, exploiting known vulnerabilities, or buying access outright from third-party “initial access” brokers. From there, the playbook is consistent: escalate to administrator accounts, then disable Endpoint Detection and Response (EDR) tooling before exfiltrating data and/or deploying ransomware. In at least one observed case, the group abused a vulnerability in an obscure third-party driver to blind EDR from the inside, a technique known as “bring your own vulnerable driver.” The sophistication isn’t in any single step; it’s in a toolkit built to defeat the defenses victims already have installed.

The operating assumption for 2026 is that exfiltration precedes encryption. By the time ransom notes appear on screens, data has typically already left the building. Recovery costs for healthcare breaches averaged about $7 million per incident last year, and stolen data keeps generating leverage long after systems are restored, because leaked sexual assault and mental health records bring lawsuits, regulatory penalties, and reputational damage that no backup can undo.

Prevention: What Actually Moves the Needle

None of this requires an enterprise security budget to start. The controls that block or slow most of these incidents are unglamorous and within reach of any IT team.

Turn on multi-factor authentication everywhere remote. Every VPN, every remote login, every admin account. Where possible, use phishing-resistant options like passkeys or hardware security keys instead of text-message codes. If a vendor or firewall can’t support MFA, replace the vendor or firewall; don’t skip the control.

Verify before you reset. Help desk staff should confirm a caller’s identity through a separate, known channel before resetting passwords or MFA, no matter how urgent the request sounds.

Separate public-facing accounts from internal ones. Social media logins, appointment-reminder systems, and marketing tools should never share credentials or password patterns with clinical or administrative systems, and each should have its own MFA.

Keep backups the attacker can’t reach. Backups need to be offline, off-site, or otherwise walled off from the live network, and tested regularly to confirm they restore.

Practice running without computers, on purpose, regularly. Paper charting and phone-tree communication should be drilled like a fire evacuation, not filed away after an annual compliance checkbox.

Decide who makes the hard calls before there’s a crisis. Who decides whether to pay, who talks to reporters, who can shut down a compromised social media account: each needs a name attached in advance.

Tell patients and staff what a scam looks like before they need to know. A short, plain-language warning prepared in advance, such as “we will never ask you to make a payment by text,” can go out within hours instead of days.

The Bottom Line

Performance doesn’t rise to the occasion; it falls back on preparation. AnMed’s emergency rooms, labs, and urgent care held throughout, proof of real muscle memory for degraded operations. The public timeline looks slow, 26 days to confirm a breach and nearly two months without notification letters, but the work that matters most happens on a clock nobody outside the organization can see. The only way to be ready for it is to practice before the pressure is real: MFA on every door, backups the attacker can’t burn, and a plan that’s been run at least once.

This analysis reflects public reporting available through September 23, 2026.

References

1. Healthcare IT News, “AnMed given 72 hours to respond to demands in ransomware incident,” July 27, 2026. https://www.healthcareitnews.com/news/anmed-given-72-hours-respond-demands-ransomware-incident

2. Healthcare IT News, “Potential payment scam related to AnMed cyberattack,” August 2026. https://www.healthcareitnews.com/news/potential-payment-scam-related-anmed-cyberattack

3. Healthcare IT News, “Patient data was breached in AnMed attack,” August 2026. https://www.healthcareitnews.com/news/patient-data-was-breached-anmed-attack

4. Healthcare Dive, “10 AnMed facilities remain closed a week after cyberattack,” August 5, 2026. https://www.healthcaredive.com/news/anmed-facilities-remain-closed-week-after-cyberattack/827160/

5. HIPAA Journal, “AnMed Investigating Ransomware Group’s Data Theft Claims,” August 13, 2026. https://www.hipaajournal.com/anmed-closes-almost-80-facilities-while-it-grapples-with-cyberattack/

6. The Record (Recorded Future News), “Ransomware group hijacks hospital system’s Facebook page amid ongoing cyberattack fallout,” August 11, 2026. https://therecord.media/ransomware-group-hijacks-hospital-facebook-amid-cyberattack-response

7. Becker’s Hospital Review, “AnMed confirms data theft in cyber incident,” August 21, 2026. https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-confirms-data-theft-in-cyber-incident/

8. Becker’s Hospital Review, “AnMed warns patients about suspicious messages amid cyber incident,” July 30, 2026. https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/anmed-warns-patients-about-suspicious-messages-amid-cyber-incident/

9. BankInfoSecurity, “AnMed Confirms Data Theft, Warns Patients of Criminal Scams,” August 2026. https://www.bankinfosecurity.com/anmed-confirms-data-theft-warns-patients-criminal-scams-a-32642

10. WSPA 7NEWS, “AnMed cyberattack: What happened and who is behind it,” August 22, 2026. https://www.wspa.com/news/local-news/anmed-cyberattack-what-happened-and-who-is-behind-it/

11. ComplianceHub.Wiki, “83 Facilities Closed, Four Weeks to Confirmation: AnMed’s July Attack and the HIPAA Discovery Clock.” https://compliancehub.wiki/anmed-health-july-2026-attack-data-theft-confirmation-hipaa-discovery-clock/

12. Greenville Business Magazine, “Cyberattack on AnMed Reveals Vulnerabilities of Data Privacy.” https://www.greenvillebusinessmag.com/stories/cyberattack-on-anmed-reveals-vulnerabilities-of-data-privacy,54322

13. FOX Carolina, “AnMed launches centralized phone line, addresses data security after cyberattack,” August 2, 2026. https://www.foxcarolina.com/2026/08/02/anmed-launches-centralized-phone-line-addresses-data-security-after-cyberattack/

14. breached.company, “The Gentlemen Took AnMed’s Facebook Page to Extort It in Front of Its Own Patients.” https://breached.company/anmed-gentlemen-ransomware-facebook-hijack-6tb-2026/

15. Upstate Today, “Group hacks AnMed social media page, makes dozens of posts, officials say” (citing Palo Alto Networks and FortiGuard research on The Gentlemen). https://upstatetoday.com/eedition/page-a01/page_6c18f5be-bd85-50c5-bef9-9893d721b1bc.html

16. Anderson Observer, “News Analysis: AnMed Still Working to Restore Services, Repair Ransomware Damage,” August 2026. https://www.andersonobserver.com/news/news-analysis-anmed-still-working-to-restore-services-repair-ransomware-damage

17. Class Action U, AnMed data breach tracking page. https://classactionu.org/current-data-breaches/anmed/