Loading story…
AnMed, an independent not-for-profit health system serving Upstate South Carolina and northeast Georgia, reported a malware-related cybersecurity disruption that knocked out phone and internet services across all hospital locations and caused widespread network outages. The incident affected four hospitals and disrupted communications and clinical operations as the organization worked to restore systems and determine the scope of the attack.
The outage forced dozens of departments and facilities to close, including imaging, OBGYN, primary care clinics, and medical group offices, while emergency rooms and urgent care locations remained open and continued seeing patients. AnMed said it was coordinating with emergency medical services, regional hospitals, and public safety partners to maintain patient care during the disruption.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
AnMed disclosed that malware affected its networks, causing widespread operational outages and forcing dozens of departments and facilities to close, including imaging, OBGYN, primary care clinics, and medical group offices. The health system said urgent care remained open and that it was working to restore systems, assess the scope of the incident, and coordinate with emergency services and regional partners.
AnMed reported that all hospital locations were experiencing a phone and internet outage, while emergency rooms remained open and continued seeing patients. The disruption affected the health system's four hospitals serving Upstate South Carolina and northeast Georgia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AnMed, a nonprofit healthcare system serving South Carolina and Georgia, is dealing with prolonged disruption after a malware-related cyberattack that the **The Gentlemen** ransomware group has claimed as its own. Reports say the incident affected hospitals and clinics, with some facilities remaining closed, and the group later used AnMed’s Facebook page to post ransom demands. AnMed said the social media posts were unauthorized, removed them, disabled access to the platform, and continues to investigate whether patient information was compromised. The attackers also claimed to have stolen **6 TB** of sensitive data, although AnMed said those assertions have not been verified. The incident comes amid a broader rise in ransomware activity, with Comparitech reporting **799 claimed attacks** in July and identifying **The Gentlemen** and **Qilin** as the most active groups, together accounting for roughly **33%** of all claims. Healthcare was among the sectors seeing the sharpest increase, underscoring continued pressure on U.S. medical organizations.
Aug 12, 2026
Signature Healthcare in Brockton, Massachusetts said a cyberattack disrupted clinical and administrative operations across its hospital and outpatient network, forcing the diversion of ambulance traffic and taking electronic health records and the patient portal offline. The incident also halted prescription filling at the organization's two retail pharmacies and temporarily canceled chemotherapy infusion services, while inpatient care, emergency walk-in services, surgeries, and some procedures continued. The provider said its medical group and urgent care practices remained open, although patients could face delays as response efforts continued. The disruption adds to a broader run of cyber incidents affecting U.S. healthcare organizations, including a February ransomware attack on the University of Mississippi Medical Center and a January breach at Nacogdoches Memorial Hospital that affected more than 257,000 people; Signature Healthcare had not disclosed further technical details about the attack at the time of reporting.
Jun 29, 2026
The **University of Mississippi Medical Center (UMMC)** reported a **ransomware attack** that knocked multiple IT systems offline, including access to its *Epic* electronic health record (EHR) platform, triggering the organization’s emergency operations plan. The disruption forced UMMC to **close all 35 clinics statewide** and **cancel outpatient, elective, and clinic procedures**, while hospital and emergency services remained open under contingency operations. UMMC stated the attackers have been in communication and that it is working with external specialists and law enforcement; the **FBI is investigating** and warned the duration of the outage was unknown at the time of reporting. Separate reporting also described a different municipal incident in **Meriden, Connecticut**, where officials took city internet services and public Wi‑Fi offline after an attempted disruption; emergency services were reported as unaffected and the city said it would conduct a comprehensive review before restoring service.
Jun 29, 2026