(ANDERSON, S.C. – August 21, 2026 – 9:30 a.m.) AnMed continues working with outside cybersecurity specialists to investigate the July cybersecurity incident, and to restore the remaining systems and services affected by the incident.
AnMed CEO William Kenley has shared a video message with patients, employees and the community to explain what AnMed knows, what may happen next, and the steps people should take if they receive a suspicious communication.
The investigation has now reached a point where AnMed can share additional information with the community. It has confirmed cybercriminals obtained information from AnMed, and we are conducting a thorough review to determine what information was involved and identify the individuals who may require notification.
This process is resource-intensive and takes time to complete accurately because it requires careful analysis and validation of the information. Although the cybercriminals have made public statements characterizing the information they claim to possess, those statements are general and do not provide a sufficient basis for determining what information was actually affected or whose information may be involved. AnMed will not rely on those characterizations and will instead complete a comprehensive, independent review before drawing conclusions or providing notifications.
As that review continues, AnMed also wants the community to be prepared for what may happen next. The individuals responsible may attempt to publish information, contact patients or employees, or make additional public claims. Anyone who receives an unexpected communication claiming to involve AnMed information should not respond, click links, open attachments, provide personal information or make a payment. If a communication includes a direct threat, it should be reported to law enforcement.
AnMed understands the concern this situation may cause and is committed to notifying affected individuals directly once the review is complete. AnMed will also provide appropriate resources based on the information involved.
AnMed has remained open and continued caring for patients throughout the incident and recovery process. Phone service, read-and-write access to electronic health records and patient access to MyChart have been restored. Teams continue working to safely restore additional systems and services.
Once the investigation is complete, AnMed will review what occurred, identify lessons learned and make appropriate adjustments to its systems, processes and safeguards. Verified updates and patient guidance will continue to be available at go.anmed.org/latest-updates.
