AnMed Shuts 79 Facilities After Malware Attack Knocks Out IT Systems
South Carolina's largest independent health system canceled elective procedures and closed most outpatient locations following a cybersecurity incident that began July 26, 2026.
AnMed, the largest independent nonprofit health system in South Carolina, closed 79 facilities after a malware attack disrupted critical IT infrastructure across its network serving upstate South Carolina and northeast Georgia.
The incident began Sunday, July 26, 2026, knocking out email, phone lines, internet connectivity, and the MyChart patient portal. The system canceled elective procedures scheduled for Monday and shuttered most outpatient locations including all AnMed Medical Group offices and imaging services.
Critical Services Remain Operational
Emergency departments, urgent care locations, laboratory services, and integrated therapy locations remained open. AnMed stated that "decisions regarding procedures, patient transfers, diversions and operational processes are being made with patient safety as the guiding principle."
The 461-bed AnMed Medical Center in Anderson continued operating emergency services. "AnMed is currently experiencing a cybersecurity disruption involving malware that is impacting our network," the health system said in an official statement.
Ransom Demand Reported by Patient
A patient reported seeing a blue screen message on hospital computers stating that AnMed had 72 hours to pay a ransom or patient information would be leaked. AnMed has not confirmed this claim.
The health system is working with third-party cybersecurity specialists and state and federal authorities to restore affected systems. The closure of nearly 75% of facilities underscores the vulnerability of healthcare infrastructure to cyberattacks that can halt both administrative functions and patient care delivery.
Broader Healthcare Targeting Trend
The attack follows a pattern of healthcare organizations being targeted by ransomware and malware groups seeking to extort payments through threats of leaking sensitive patient data. When critical IT systems fail at hospitals, the impact extends beyond paperwork delays to canceled surgeries, closed clinics, and potentially delayed treatments.
AnMed serves a broad geographic area across upstate South Carolina and northeast Georgia. The system has not provided a timeline for restoring full operations or confirmed whether patient data was accessed or exfiltrated.