AnMed Data Breach Exposes Sensitive Personal and Health Information of Patients

AnMed, an independent, not-for-profit health system based in Anderson, South Carolina, experienced a cybersecurity incident in July 2026 that disrupted its network and potentially exposed sensitive patient information. The total number of individuals affected has not been publicly disclosed.

AnMed posted a notice about the data security event on its website, as well as reported the incident to the U.S. Department of Health and Human Services on Aug. 27, 2026

On July 26, 2026, AnMed announced experienced a cybersecurity disruption involving malware that impacted their network.

A ransomware group known as The Gentlemen claimed responsibility for the attack. On July 27, 2026, the group posted on the dark web, claiming to have obtained AnMed's data and stating its intention to publish the information within nine to 10 days.

The disruption greatly hindered hospital operations. Electronic systems, including access to medical records, became unavailable. AnMed Medical Group offices and AnMed Imaging Services were closed on July 27, 2026.

AnMed's clinical teams relied on established downtime procedures and clinical judgment to continue providing patient care while systems remained offline. Additionally, providers had limited access to patients' medical records and histories, which meant they may not have been able to safely answer individual clinical questions during the disruption.

The types of information confirmed to have been potentially compromised in the breach included Social Security numbers, medical record numbers, dates of birth, contact information (such as addresses), demographic information, clinical information, treatment and medical information (such as medical history, diagnoses and medications) and financial information (such as billing and insurance information).

AnMed's response to the breach

AnMed is working diligently to investigate the full nature and scope of the incident with the assistance of third-party cybersecurity specialists and state and federal authorities.

The company will notify impacted individuals in accordance with applicable laws and provide guidance on recommended next steps.