Gentlemen Ransomware Gang Publishes 6TB of AnMed Patient Data, Another Warning Shot for Healthcare

South Carolina nonprofit health system AnMed confirmed that the ransomware attack detected on 26 July led to theft of 6TB of patient and corporate data. Ransomware group Gentlemen claimed on the dark web it stole sensitive records covering mental health, sexual assault, reproductive care, genetic testing, and cancer. Attackers also seized AnMed's Facebook account to post threats. Another exposure of healthcare's ransomware weakness.

Nonprofit health system AnMed, serving South Carolina's Upstate and northeast Georgia, confirmed this week that the ransomware attack detected on 26 July 2026 involved data theft. The Gentlemen gang claims it stole about 6TB of sensitive patient and corporate information. AnMed CEO William Kenley issued a public statement and video warning patients to watch for follow-on scams and impersonation. AnMed will not rely on the attackers' self-disclosure; it will notify affected patients individually after independent review.

Incident Overview

AnMed is a nonprofit health system serving multiple counties in South Carolina's Upstate and northeast Georgia, covering hospitals, specialty clinics, imaging centers, and urgent care. The attack was detected on 26 July. AnMed shut some facilities to contain spread. IT disruption lasted weeks. Gentlemen then claimed on its dark-web leak site that it stole 6TB covering mental health, sexual assault, reproductive care, genetic testing, and cancer-related records. Gentlemen also seized AnMed's Facebook account after the attack and posted threat messages, amplifying impact.

Technical Details

AnMed has not disclosed the initial access vector. From Gentlemen's TTPs and recent healthcare ransomware evolution, typical traits:

• Initial access: phishing, internet-exposed remote access (RDP, VPN, Citrix), compromised third-party vendor accounts, or unpatched edge-device flaws
• Lateral movement and data theft: after the foothold, Active Directory lateral movement, Living-off-the-Land binaries (LOLBins) to evade detection, and large-scale exfil of critical business data, typically 7 to 14 days
• Double extortion: steal data before encrypting production, then threaten public release to force a choice between recovery and privacy exposure
• Brand damage: takeover of AnMed's Facebook account to post threats, amplifying impact on reputation and patient trust

Gentlemen is an active 2026 ransomware group, alongside Qilin, Akira, DragonForce, and INC Ransom. The group maximizes pre-encryption exfil and pressures victims via public channels including social media.

Impact Assessment

CVSS: N/A (no CVE). Attack complexity: medium (depends on initial access). Privileges required: typically a low-privilege account or external attack surface. PoC public: N/A. Known malicious use: Gentlemen published victim information and issued further threats. Impact surface: AnMed current and historical patients, employees, contractors, and upstream/downstream partners. Healthcare remains a top ransomware target: downtime hits patient care, backups are hard to restore, regulatory fines are high, and attackers have strong leverage.

Remediation

• Inventory every internet-facing remote-access entry (RDP, VPN, Citrix, remote-management platforms). Shut unnecessary public exposure. Enforce MFA and least privilege.
• Clean Active Directory and privileged accounts. Disable weak passwords, long-unrotated service accounts, and over-privileged Tier 0 accounts.
• Deploy EDR/XDR with behavior rules. Watch abnormal use of PowerShell, WMI, PsExec, and other LOLBins.
• Build offline, immutable backups (e.g. S3 Object Lock, isolated media snapshots). Rehearse restore quarterly so critical services recover within RTO after encryption.
• Deploy DLP and outbound traffic monitoring to detect bulk exfil and auto-alert.
• Put independent accounts, least privilege, MFA, and anomalous-login detection on social media, customer-service, and email brand touchpoints so attackers cannot use them for secondary pressure.
• Maintain and regularly exercise an incident-response plan covering healthcare-specific HIPAA, regulatory notification, and patient-notice requirements.

Detection Rules

• EDR process behavior: HIS processes (Epic, Cerner, MEDITECH, etc.) spawning PowerShell, cmd, wmic, rundll32, or other abnormal children
• Network traffic: anomalous large file transfers from clinical servers to external IPs; bulk outbound data off-hours
• AD behavior: anomalous privileged-account logons, Kerberos golden-ticket indicators, abnormal DC replication
• Backup alerts: backup job failures, encrypted backup data, signs of backup-store tampering
• Social/brand monitoring: anomalous logins on corporate social accounts, third-party app authorization changes, suspicious posts and DMs

Healthcare ransomware has three amplifiers: direct operational impact, high regulatory pressure, and highly sensitive data. That is why Gentlemen, Qilin, and peers have prioritized the sector. AnMed is a reminder that perimeter defense and backup restore alone do not stop modern ransomware crews. Identity security, network segmentation, behavior detection, brand-touchpoint protection, and cross-team IR must be standing capabilities, with restore drills against realistic scenarios.

References

• BankInfoSecurity: AnMed confirms data theft and warns patients about scams
• HealthInfoSecurity: recap of AnMed's July malware attack