AnMed: The Gentlemen Ransomware Data Theft Claims

AnMed, a nonprofit regional health system operating four hospitals and a network of clinics across South Carolina and Georgia, is investigating claims by the ransomware-as-a-service group The Gentlemen that it exfiltrated 6TB of highly sensitive patient data. The health system has publicly acknowledged a "cybersecurity disruption involving malware" identified on July 26, 2026, but has pointedly not named a threat actor and says the claims circulating under the group's name "have not been verified." The actor escalated on August 11 by posting a ransom demand directly to AnMed's own Facebook page. Three weeks in, AnMed has restored electronic health record documentation, phone lines, and partial MyChart access, with roughly 10 to 11 facilities still closed depending on the day of reporting.

What Happened

AnMed disclosed a cybersecurity incident on Sunday, July 26, 2026, initially describing it as a disruption "involving malware." The attack knocked out IT systems across the chain and forced rolling closures of clinics and offices, tracked through daily open/closed facility updates published by the health system.

Two weeks later, on August 11, messages purporting to come from The Gentlemen appeared on AnMed's official Facebook page. The Record reports the page itself was removed from Facebook shortly after the messages appeared; the Anderson Independent Mail reports the post and the page were deleted immediately after posting. Either way, the content is gone, and AnMed confirmed the same day that it had "identified unauthorized posts on its social media accounts," removed the content, disabled platform access, and was working with the provider to secure the accounts.

AnMed has consistently declined to attribute the attack. The Gentlemen claimed responsibility independently by adding AnMed to its dark web leak site, per Healthcare Compliance Journal and HIPAA Journal. AnMed's public position on its website, as of The Record's reporting, is that it has not "confirmed the scope of any potential impact to patient information." The health system has said determining the full extent of any data theft could take time, and that it will provide notifications if the investigation determines personal information was affected.

Recovery has been incremental. Care teams regained the ability to view and document in patient electronic health records on August 11. Phone lines to physician offices and departments were restored by August 12 to 13, along with MyChart logins for patients with an active account and a mobile number on file, gated behind an SMS one-time code. Not all MyChart features are back. On facility closures, accounts differ slightly by date: The Record put the figure at 10 facilities closed as of Monday, August 10, while HIPAA Journal and the Independent Mail both cite 11 remaining closed later in the week.

What Was Taken

Nothing is confirmed. What exists is an actor claim, unaccompanied by proof.

The Facebook post, quoted verbatim and consistently across HIPAA Journal, the Independent Mail, and Healthcare Compliance Journal, read: "Gentlemen, your confidential data has been exfiltrated. 6TB: HIV+ patients, suicide registries, sexual assault & rape victims, mental health, abortions, genetic data, patient SSN/DOB, autopsy & police evidence. Deletion on payment." A payment link was appended to the post. All sources agree on the 6TB figure and on the categories claimed, so there is no numerical conflict to reconcile here.

The critical caveat comes from The Record: the attackers "did not provide any evidence to back up these claims." No sample files, no directory listings, no proof-of-life dump has been reported by any source. AnMed has verified none of it.

If even partially accurate, the claimed data set is close to a worst case for a healthcare victim. HIV status, mental health treatment records, sexual assault and rape victim records, abortion records, and suicide registries carry legal protections beyond standard HIPAA PHI in many jurisdictions and carry extortion leverage against individual patients, not just the institution. The inclusion of autopsy and police evidence suggests the actor believes it touched forensic or medical examiner systems. Treat the specificity as a pressure tactic until corroborated: naming the most damaging possible categories is cheap, and the group's decision to post publicly rather than negotiate quietly is itself a sign the extortion is not going its way.

Why It Matters

The Facebook hijack is the story defenders should focus on. Posting a ransom note to the victim's own verified social account is a meaningful escalation past leak-site listings and journalist tip-offs: it puts the demand in front of patients, staff, and local media simultaneously, in a channel the victim controls and is trusted on. It also implies the actor either compromised social media credentials during the intrusion or acquired them separately, which means the incident's blast radius extends into SaaS and marketing platforms that most healthcare IR playbooks do not scope on day one.

The Gentlemen's trajectory is the second reason to pay attention. Per Dragos's Industrial Ransomware Analysis, cited by both Healthcare Compliance Journal and HIPAA Journal, the group was the third most active ransomware operation in Q2 2026 with 125 claimed attacks, up from 83 in Q1, the largest quarter-over-quarter gain among established groups. HIPAA Journal adds important context that the compliance-focused write-up omits: only 15 attacks separated the top three groups, meaning no single operation currently dominates the landscape.

Palo Alto Unit 42's research explains the recruiting engine behind that growth. The Gentlemen, tracked by Microsoft as Storm-2697, has been active since at least July 2025, with operators likely running earlier as the "ArmCorp" affiliate of Qilin RaaS (Unit 42's Spikey Scorpius). Roughly 20 operators moved the outfit from a private crew to a RaaS model around September 2025, and they offer affiliates an unprecedented 90% cut of paid ransoms against an industry norm of 70 to 80%. In May 2026 the group announced a partnership with HasanBroker's BreachForums to recruit affiliates, penetration testers, and initial access brokers. The Record attributes the group's founding to a former Qilin affiliate using a moniker beginning "hastal," which is consistent with, though not identical to, Unit 42's ArmCorp lineage; the accounts overlap rather than conflict.

The Attack Technique

AnMed has not disclosed an initial access vector, and none of the sources establish how the July 26 intrusion began. What follows is the group's documented tradecraft, not confirmed AnMed incident detail.

Unit 42 reports The Gentlemen uses a broad initial access mix: exploitation of edge device vulnerabilities in firewalls and VPNs, brute force attacks, leaked or stolen credentials, and purchased access from initial access brokers. More recently researchers have identified a custom Go-based backdoor, an EDR killer framework dubbed "GentleKiller," and suspected use of an unspecified zero-day exploit for defense evasion. Encryptors are written in both C and Go, targeting multiple operating systems and virtual infrastructure.

CSO Online, drawing on a Picus Security report and a Microsoft Threat Intelligence encryptor analysis published in late May 2026, details the post-foothold behavior that makes this operation dangerous. The Windows encryptor is written in Go and obfuscated with Garble. Its self-propagation capability enumerates reachable systems, stages the binary through an SMB share, and attempts up to 21 distinct remote execution operations per target, including PsExec, WMIC, scheduled tasks, Windows services, PowerShell remoting, and WMI process creation. The redundancy is deliberate: only one method has to work. Before encryption it disables Microsoft Defender, deletes shadow copies, removes forensic artifacts, and stops services tied to databases, backup tools, endpoint protection, and virtualization platforms. Other researchers have reported Gentlemen tooling aimed at Linux and VMware ESXi. Victims span education, transportation, healthcare, and financial services across North America, South America, Europe, Africa, and Asia.

What Organizations Should Do

1. Scope social and SaaS accounts into ransomware IR from hour one. The AnMed Facebook hijack shows extortion now reaches into marketing platforms. Rotate credentials and revoke sessions for social, CRM, patient communication, and email marketing tools during any suspected intrusion, and enforce hardware-backed MFA plus business-manager-level access controls on all official brand pages.
2. Harden the lateral movement paths the encryptor actually uses. Block or tightly restrict SMB admin share writes between workstations, restrict PsExec/WMI/WinRM remote execution to jump hosts, and alert on scheduled task and service creation on remote systems. With 21 propagation attempts per target, one open method is enough.
3. Make backups and shadow copies survive the operator. Enforce immutable or offline backup copies, separate backup infrastructure credentials from the production domain, and alert loudly on vssadmin/wbadmin deletion, Defender tamper events, and mass service stops against database, backup, and hypervisor services.
4. Close the edge device and credential gap. Patch internet-facing firewalls and VPN appliances on an aggressive cycle, enforce MFA on all remote access, and hunt for valid-account abuse and IAB-sourced credentials rather than assuming exploitation. This is the group's documented entry pattern.
5. Protect ESXi and Linux estates explicitly. Windows-only EDR coverage leaves hypervisors exposed. Enable lockdown mode, restrict SSH, isolate the management network, and monitor for anomalous VM shutdown and datastore encryption activity.
6. Pre-plan the communications failure mode. Have an out-of-band patient and staff notification channel ready that does not depend on compromised social accounts or the patient portal, and rehearse how you respond publicly to unverified data-theft claims before you need to.

Sources: AnMed Investigates The Gentlemen Data Theft Claims - Healthcare Com... | The Ruthless Rise of The Gentlemen Ransomware | AnMed Investigating Ransomware Group's Data Theft Claims | Ransomware group hijacks hospital system's Facebook ... | Why The Gentlemen ransomware is a test of identity and recovery con... | AnMed responds to hackers claim of having patient data in social post | AnMed restores MyChart access while cyberattack probe continues | AnMed says hacker ransom posts on Facebook page are ...