Ransomware Gang The Gentlemen Claims Theft of 6TB of Sensitive Patient Information from AnMed Health System
In a troubling development within the realm of cybersecurity, AnMed Health, a nonprofit health system serving areas in upstate South Carolina and northeast Georgia, has confirmed that sensitive patient data was stolen during a significant cyberattack identified in July. This breach has led the organization to issue warnings to patients about potential scams targeted at them by cybercriminals.
The attack was first detected on July 26 and subsequently caused substantial disruption to AnMed’s IT environment and patient services, lasting for several weeks. In a public statement and video release on August 24, AnMed’s CEO, William Kenley, outlined the urgent situation, emphasizing that the organization is engaged in a "resource-intensive" analysis to uncover the full extent of the data breach.
Kenley articulated the complexity of the situation, noting, "The attack was orchestrated by a group of individuals motivated by financial gain. This is a very complicated and rapidly changing situation." His comments underscored the uncertainty surrounding the breach and the potential ramifications for patients whose information may have been compromised.
AnMed’s public statement addressed the claims made by the ransomware group known as The Gentlemen, which alleged that it had stolen a staggering 6 terabytes of AnMed’s corporate and patient data. This purported data encompasses sensitive records, including information related to mental health, sexual assaults, reproductive care, genetic testing, and cancer. In light of the hackers’ assertions, AnMed has expressed skepticism about the specificity and reliability of the claims regarding the information stolen.
AnMed clarified that despite the group’s general characterizations of the stolen data, they would rely on a comprehensive, independent review to ascertain the specifics of the breached information rather than the hackers’ claims. “AnMed will not rely on those characterizations and will instead complete a comprehensive, independent review before drawing conclusions or providing notifications,” the organization stated.
In an effort to address the distress that this incident may cause, Kenley acknowledged the fears many patients might have regarding their personal information. He described the hack as "a scary situation" and reiterated that the potential for personal information to be misused is deeply concerning.
The ransomware gang’s actions extended beyond just theft; they also compromised AnMed’s Facebook account, using it to post a series of threats aimed at the organization. This issue prompted AnMed to take down its social media pages in order to mitigate the continued risk of misinformation and intimidation.
As the investigation continues, AnMed has emphasized the importance of community preparedness for possible further escalation by the attackers. The organization advised patients and employees to be vigilant about unexpected communications that might claim to involve AnMed’s information. They instructed anyone who receives such communications not to respond, click on links, open attachments, provide personal information, or make payments. Additionally, they urged anyone receiving direct threats to report such incidents to law enforcement authorities.
Regarding the next steps, AnMed Health has committed to notifying affected patients directly once the thorough review of the breach is finalized. They assured that once the specifics are available, "AnMed will also provide appropriate resources based on the information involved."
In a positive development for the healthcare provider and its patients, AnMed reported that services affected by the cyberattack, including phone service, read-and-write access to electronic health records, and access to the MyChart patient portal, have been restored. The organization also stated that teams are actively working to safely reinstate additional systems and services that were impacted by the attack.
In conclusion, as the health sector faces increasingly sophisticated cyber threats, this incident highlights the urgent need for enhanced cybersecurity measures and ongoing vigilance. It serves as a stark reminder to both organizations and individuals about the importance of safeguarding sensitive information in an increasingly digital landscape.