AnMed, a nonprofit health system serving upstate South Carolina and northeast Georgia, confirmed it was hit by a malware incident on Sunday that knocked out IT systems and internet access across its footprint. Healthcare IT News reported that the Anderson, South Carolina-based system canceled all elective procedures scheduled for Monday, closed oncology and radiation services, and shuttered AnMed Medical Group and all imaging services. A patient interviewed by local NBC affiliate WYFF described a blue screen on hospital computers carrying an extortion note: AnMed had 72 hours to pay, or patient information would be leaked.
What Happened
The incident began Sunday and escalated into a full IT outage affecting systems, internet connectivity and clinical workflows. By Monday, AnMed had published a running list of operational status by location. Oncology and radiation services were closed. Infusion services were limited. AnMed Medical Group and all imaging services were closed. Every elective procedure on Monday's schedule was canceled.
Services that stayed open included general laboratory, emergency departments, urgent care, integrated therapy locations and AnMed Kids Care. The health system said "decisions regarding procedures, patient transfers, diversions and operational processes are being made with patient safety as the guiding principle," and that it was "coordinating closely with emergency medical services, regional hospitals and public safety partners to ensure patients continue to receive the care they need in the most appropriate setting."
The 72-hour ultimatum is the detail that separates this from a straightforward encryption event. A countdown paired with a leak threat is the signature of double extortion: the attacker has already staged or exfiltrated data and is using publication, not just downtime, as the pressure lever. AnMed has not publicly confirmed exfiltration, and no threat group had claimed the intrusion at the time of reporting. Healthcare IT News said it reached out to a health system contact about operations during the disruption and would update if a response came.
What Was Taken
Unconfirmed at this stage. The only public signal on data theft is the ransom note itself, relayed secondhand by a patient who saw it on hospital screens and was told what it said by a frontline clinician. That note asserted "everybody's information would be leaked" absent payment within 72 hours.
Treat that as a claim, not a finding. Ransomware operators routinely overstate the volume and sensitivity of what they hold to accelerate payment. That said, a health system of AnMed's scope holds the full range of high-sensitivity records: patient demographics, Social Security numbers, insurance and billing data, clinical notes, imaging studies, lab results, and employee HR and payroll files. The closure of imaging and oncology services in particular suggests the intrusion reached clinical systems rather than stopping at corporate IT.
No volume figure, record count or data sample has surfaced publicly. If a leak-site post appears after the deadline, that will be the first hard evidence of what was actually staged out of the environment.
Why It Matters
This is a physical-harm incident wearing an IT-incident label. Canceled elective procedures and closed radiation oncology services are not inconveniences for a cancer patient mid-course; radiation schedules are dose-timed, and interruptions carry clinical consequences. Diverting patients to regional hospitals shifts load onto neighboring facilities that did not budget for it.
The 72-hour window is engineered against exactly this. Attackers targeting healthcare know the victim is negotiating against a clock measured in patient outcomes, not quarterly earnings. That asymmetry is why the sector remains a preferred target and why recovery costs averaged roughly $7 million per breach last year, per figures cited in the reporting.
There is a counterweight worth noting. Zachary Lewis, CIO and CISO at University of Health Sciences and Pharmacy in St. Louis, told a HIMSS26 keynote in March that while these attacks continue to increase, organizations are measurably getting better at recovery. His own organization was hit by a LockBit affiliate, with the initial weakness traced to process changes made when hardware arrived with a flawed firewall during the onset of the COVID-19 pandemic. The lesson there is durable: temporary pandemic-era exceptions became permanent gaps.
AnMed's decision to keep emergency departments, urgent care and general labs running while shutting imaging and elective care reads as a deliberate segmentation call. Whether that reflects planned architecture or triage under fire will matter for anyone benchmarking their own downtime posture.
The Attack Technique
Unknown. No initial access vector, malware family or threat group has been identified publicly. AnMed has described the event as a "malware incident" and has not named an actor. The extortion note's format, a full-screen ransom message pushed to endpoints across the environment with a fixed payment deadline and a leak threat, is consistent with commodity ransomware-as-a-service operations rather than anything exotic.
What the observable damage does suggest: the actor achieved broad reach. Losing IT systems, internet access, imaging and clinical scheduling simultaneously points to domain-level compromise or hypervisor-level encryption rather than a contained foothold. That pattern typically follows one of a short list of entry points, none of which are confirmed here: exposed or unpatched edge devices such as VPN concentrators and firewalls, valid credentials bought or phished with no phishing-resistant MFA in the path, or a compromised third-party remote-access channel.
The Lewis anecdote in the source reporting is instructive on the firewall angle specifically. Flawed edge hardware plus a process workaround was enough to hand LockBit an opening at a different organization. Anyone reading this brief should assume their own edge inventory is the first place to look.
What Organizations Should Do
Audit every internet-facing appliance this week. VPN gateways, firewalls, remote-access portals and file transfer tools. Confirm firmware is current, confirm no default or shared admin credentials survive, and confirm management interfaces are not reachable from the internet. Edge devices are the dominant ransomware entry point into healthcare.
Enforce phishing-resistant MFA on remote access and privileged accounts. SMS and push-approval MFA are routinely defeated by fatigue attacks and adversary-in-the-middle kits. FIDO2 or certificate-based authentication on VPN, VDI, admin accounts and email closes the credential-replay path that most affiliates rely on.
Verify that backups are offline, immutable and actually restorable. Not that they exist. Pull a real restore of a clinical system into an isolated environment and time it. Ransomware operators hunt backup infrastructure before they encrypt, and a backup on a domain-joined server is not a backup.
Segment clinical from corporate, and imaging from both. AnMed kept emergency and lab services running while imaging went dark. That is the outcome segmentation buys you. Map which clinical systems would survive a full corporate domain compromise, and fix the ones that would not.
Write and rehearse the downtime procedures for radiation, oncology and surgery specifically. Paper workflows for the ED are common; dose-timed radiation scheduling and elective surgery coordination usually are not. Include patient transfer criteria, EMS coordination and regional hospital diversion agreements, and test them before you need them.
Hunt for exfiltration staging now, not after the ransom note. Look for large outbound transfers to cloud storage providers, unexpected archive creation on file servers, and rclone, WinSCP or MEGA clients on systems that have no business running them. Double extortion means the data leaves before the encryption starts, and that window is where detection is still cheap.
Retire pandemic-era exceptions. Every temporary firewall rule, standing remote-access grant and process workaround from 2020 through 2022 that never got reversed. That is precisely the failure mode Lewis described.
Sources: AnMed given 72 hours to respond to demands in ransomware incident