Key takeaways
- According to public reporting from outlets including The Record, Healthcare Dive, and the HIPAA Journal, AnMed, a nonprofit health system in South Carolina and Georgia, was hit by a cyberattack on July 26, 2026 that forced the temporary closure of more than 80 facilities.
- A group calling itself The Gentlemen claimed responsibility on August 10 and allegedly posted an extortion message to the health system’s Facebook page the following day. AnMed has said the group’s claims are unverified.
- The group allegedly claims six terabytes of data including records tied to sexual assault, mental health, and other highly sensitive categories. No evidence has been published to support the figure.
- When an organization cannot bound an exfiltration claim from its own records, the attacker’s number becomes the working assumption for patients, regulators, and press.
On July 26, 2026, AnMed, a nonprofit health system built around a 461-bed medical center in Anderson, South Carolina and more than sixty physician practices across South Carolina and Georgia, was disrupted by a cyberattack. According to public reporting from outlets including Healthcare Dive, The Record, and the HIPAA Journal, the response required temporarily closing more than eighty facilities, and roughly ten were still closed to appointments two weeks later.
On August 10 a ransomware group calling itself The Gentlemen claimed the attack. Reporting indicates that the following day an extortion message appeared on the health system’s own Facebook page, and that the group allegedly claims to hold six terabytes of data including records related to sexual assault, mental health, abortion, and sexual harassment complaints. AnMed has said it has not confirmed the scope of any potential impact to patient information and that the group’s claims have not been verified. No supporting evidence for the six-terabyte figure has been made public.
The claim is the leverage
Steal-and-leak extortion runs on asymmetry. The attacker asserts a number and a set of categories chosen for maximum distress. The victim, in the middle of restoring operations, can only say that the assertion is unverified. To a patient reading local news, "unverified" and "unknown" sound identical, and the attacker’s figure is the only concrete number in the story.
That asymmetry is not a communications problem. It is an evidence problem, and it is decided long before the extortion note by whether the organization kept a record of what was actually read. This could be any health system, any school district, any manufacturer. Most enterprises log authentication and infrastructure events in detail and log file access barely at all, which means the one question that matters after a data-theft claim is the one their telemetry was never built to answer.
An audit trail is a disclosure instrument
A per-operation, tamper-resistant record of which identity opened which file, when, from which host, and over which protocol changes the shape of the aftermath. It converts scoping from forensic reconstruction into a query. It lets counsel notify the people who were actually affected rather than everyone who might have been. And it lets an organization respond to a leak-site claim with specifics rather than a holding statement.
The requirement is that the record be immutable and independent of the systems under attack. An audit trail that an intruder with administrative reach can edit or delete is worth nothing at exactly the moment it is needed, which is why the trail belongs at the storage layer, written as operations occur across SMB, NFS, S3, and Web Drive, and protected from the credentials that can reach the data.
The window was open during the reads
Six terabytes, if the claim holds, does not move quietly. It is sustained, high-volume reading against production file data, and it happens before any encryption or any note. That activity is behaviorally distinct from clinical workflow in ways a system watching every file operation can measure: breadth of access across datasets an account has no history with, read rates that no human review produces, staging patterns that precede transfer. Detection there can end a session mid-exfiltration rather than confirm it months later.
The operational half deserves the same attention. Facilities closed for two weeks is a patient-care outcome, not just an IT one, and the restore-everything-and-hope approach is a large part of why recovery stretches. Immutable snapshots plus the ability to identify exactly which files were altered let a recovery be surgical, returning services in the order that matters clinically instead of waiting on a full-estate rebuild.
Nothing here reflects on how AnMed has responded; the system disclosed, engaged, and has been careful not to validate an unproven claim. The architectural lesson is about the position every organization is in when that claim arrives. Either the data layer kept a defensible record of what was read, or the criminal’s number stands unchallenged. That is decided by an architecture choice made well before the incident.
Go deeper