AnMed Health System Faces 72-Hour Deadline in Ransomware Crisis

The nonprofit health system AnMed, serving upstate South Carolina and northeast Georgia, is grappling with a severe ransomware incident that began on Sunday. The attack has knocked out IT systems, internet access, and essential services, leading to significant disruptions in patient care. With surgeries and other planned treatments delayed, the health system is under immense pressure to respond within 72 hours to demands from cybercriminals.

AnMed’s statement emphasizes patient safety as the top priority. "Decisions regarding procedures, patient transfers, diversions, and operational processes are being made with patient safety as the guiding principle," they said on their website. Despite these reassurances, many services remain closed or limited. Oncology and radiation departments were shut down on Monday, while infusions are still restricted. General lab services and emergency departments have stayed open to ensure critical care continues.

The AnMed Medical Group and all imaging services are also closed, and elective procedures scheduled for Monday were canceled. Urgent care, laboratory, integrated therapy locations, and AnMed Kids Care remain operational. "We are coordinating closely with emergency medical services, regional hospitals, and public safety partners to ensure patients continue to receive the care they need in the most appropriate setting," AnMed stated.

The Impact on Patient Care

The ransomware attack has not only disrupted IT systems but has also had a profound impact on patient care. One patient at an AnMed hospital described their experience when the computer system went down. "I was told by a frontline clinician that they were operating with paper and pen, which made everything much slower," the patient said in a report from local NBC affiliate WYFF.

The reliance on manual processes has slowed down care, causing delays and frustration for both patients and staff. AnMed is working tirelessly to restore its systems and minimize further disruptions. However, the situation highlights the vulnerability of healthcare institutions to cyber threats and the critical need for robust cybersecurity measures.

Philippe Vynckier, a cybersecurity expert, noted that ransomware attacks on healthcare providers are becoming more frequent and sophisticated. "The PEAR ransomware/extortion group, known for its aggressive tactics, claimed responsibility for stealing roughly 3TB of data from another medical billing firm in September 2025," he wrote on LinkedIn. This incident underscores the broader trend of cyberattacks targeting the healthcare sector.

What Comes Next

AnMed has stated that it will provide updates on operational plans in the coming days. The health system is likely to face a long and challenging road to recovery, including not only restoring IT systems but also rebuilding trust with patients and the community. Healthcare IT News reached out to AnMed for more details on their response plan and will update this story if there is a response.

The ransomware attack on AnMed serves as a stark reminder of the critical importance of cybersecurity in healthcare. As medical institutions increasingly rely on digital systems, they must invest in advanced security measures to protect patient data and ensure continuous care. The well-being of patients depends on it, and the stakes could not be higher.