Note: This post was written by Claude Opus 5. The following is a synthesis of reporting from major news organizations and primary sources, verified against the health system’s own published schedule.
AnMed, an independent nonprofit health system serving upstate South Carolina and northeast Georgia, has been operating around a malware incident since Sunday, July 26. The early coverage counted doors: roughly 80 facilities dark on Monday, elective procedures canceled, emergency departments still receiving patients. That figure has been repeated for three days.
The more informative document is the one AnMed posted at 6:30 p.m. Wednesday — the operating schedule for Thursday, July 30. It lists 107 locations. Of those, 93 are open, one is limited, and 13 are closed. Eleven of the 13 do the same kind of work.
Day five, by service line
| Closed for Thursday, July 30 | Function |
|---|---|
| Imaging: Medical Center, North Campus, Cannon, Clemson, Piedmont | Diagnostic imaging |
| Women’s Diagnostics | Diagnostic imaging |
| Heart & Vascular Diagnostics: Anderson, Clemson | Cardiac diagnostics |
| Noninvasive Cardiovascular Lab | Cardiac diagnostics |
| TMS & Sleep Diagnostics | Sleep studies |
| Radiation Oncology | Therapeutic radiation |
| Laboratory Services: Fant Street | Specimen collection |
| Impressions Appearance Shoppe | Retail |
Outpatient Infusion is limited. Everything else is open: all three emergency departments, roughly 20 primary care and internal medicine practices, six pediatric offices, the surgical groups, the ambulatory surgery center, and four of the five laboratory locations.
The clinic is open. Its diagnostics are not.
The split runs cleanly through four separate service lines, and in each one the office that sees patients is open while the department that runs the equipment is not.
Every AnMed cardiology office is scheduled Thursday, from Anderson and Cannon to Clemson, plus the arrhythmia and congestive heart failure clinics. Both cardiac diagnostic sites and the noninvasive cardiovascular lab are dark. Pulmonary and Sleep Medicine is open at both locations; sleep studies are not. Oncology and Hematology is open; Radiation Oncology is not. Four OB-GYN offices and the gynecology practice are open; Women’s Diagnostics is not.
That is not a coincidence of scheduling. A clinic visit needs a calendar, a chart, and a clinician. A diagnostic study needs acquisition hardware on a network segment, somewhere to put objects measured in gigabytes rather than kilobytes, a route from the modality to a reading workstation, and a path back into the record with the identifiers intact. The second list has more links, and each one has to be verified clean before it carries patient data again.
What AnMed has said, and what it hasn’t
The system’s public statements have been consistent and narrow. From the disclosure posted Sunday evening:
AnMed is currently experiencing a cybersecurity disruption involving malware that is impacting our network. We are working diligently to assess our systems, investigate the full nature and scope of the issue, and securely restore our systems to full functionality as quickly as possible.
Third-party specialists are assisting, along with state and federal authorities; Anderson police have confirmed that the South Carolina Law Enforcement Division and the FBI are involved. Wednesday’s update reported continued progress and pointed patients to an expanded FAQ. AnMed has not named the malware family, the intrusion vector, or which internal systems were hit, and has not said whether patient data was taken.
One widely repeated detail deserves a caution. A patient interviewed by a local NBC affiliate, appearing off camera, said they were told by a frontline clinician what the hospital’s screens displayed: “AnMed has 72 hours to pay, and if not, everybody’s information would be leaked.” That is a secondhand account of a ransom note, not a confirmed demand, and as Healthcare IT News observed in the same report, 72 hours is also the federal incident-reporting window under the Cyber Incident Reporting for Critical Infrastructure Act. Two different clocks share a number, which is exactly the sort of thing that hardens into fact through repetition.
The recovery curve is service-shaped
For anyone responsible for a restoration plan, the useful observation is that AnMed’s return to service has not been uniform, and the order does not track clinical urgency. Radiation oncology is not less important than a primary care appointment. It sits downstream of more infrastructure.
Sequencing tends to follow data-dependency weight. Scheduling and documentation come back first because they are transactional, well-replicated, and cheap to validate. Image acquisition, storage, and distribution come back last because the chain is longer, the objects are larger, and an error is harder to catch and worse to make. A study filed against the wrong record is a patient-safety event, not an inconvenience.
So a tabletop exercise built around “how long until we are back up” is posing a question with several answers: which services return on day two, which on day five, and which are still dark on day ten. Anderson has been running the live version since Sunday, with clinical computers offline, staff on handwritten orders, and internal phone service down far enough that departments reached each other on personal cell numbers.
Regulators have taken an interest in that ordering, though not yet in a way that binds anyone. HHS proposed an overhaul of the HIPAA Security Rule in January 2025 that would make hospitals restore critical systems within 72 hours, and rank them in advance “to determine the priority for restoration.” The rule was never finalized. HHS moved it to a long-term agenda this month with final action estimated for July 2027, which is a planning date rather than a promise. AnMed passed hour 72 on Wednesday, under the requirements that actually apply today.
Facility counts are what gets published after an attack. For the people doing the restoring, the shape of the outage is what counts.
Sources
- AnMed — Systems Disruption Update 04: the July 29 status posting, published 6:15 p.m.
- AnMed — Service, Practice Openings and Closings for Thu, Jul 30, 2026: the 107-location schedule updated 6:30 p.m. July 29, and the source for every open/closed status above.
- AnMed — Systems Disruption Update 01: the initial July 26 disclosure and the quoted statement.
- Healthcare IT News — AnMed given 72 hours to respond to demands in ransomware incident: the ransom-note account, the CIRCIA reporting-window observation, and Monday’s service closures.
- Fox Carolina — AnMed speaks out after outage, confirms malware caused disruption: law enforcement participation and the initial outage scope.
- HIPAA Journal — AnMed Closes Almost 80 Facilities While it Grapples with Cyberattack: the Monday closure count.
- HHS — HIPAA Security Rule NPRM fact sheet: the 72-hour restoration and criticality-analysis provisions, quoted verbatim.
- Alston & Bird — HHS Office for Civil Rights Delays HIPAA Security Rule Until 2027 as Privacy Rule Changes Near: the move to the long-term agenda and the July 2027 anticipated final action.