# Hospital Cyberattack Escalates as Ransomware Group Hijacks Social Media

*Published August 12, 2026*
*Source: [https://therecord.media/ransomware-group-hijacks-hospital-facebook-amid-cyberattack-response](https://therecord.media/ransomware-group-hijacks-hospital-facebook-amid-cyberattack-response)*

## Executive Summary

AnMed's IT systems have been under attack for two weeks, with the situation worsening as its Facebook page was hacked by a ransomware group claiming to have stolen 6 terabytes of sensitive data. The hospital is still investigating the extent of the breach while working to secure its online presence.

## Article

AnMed, a nonprofit medical system operating in Georgia and South Carolina, continues to face significant challenges following a cyberattack that crippled its IT systems two weeks ago. The situation escalated when the hospital's Facebook page was compromised, displaying ransom demands from a group identified as 'The Gentlemen'. This ransomware group claims to have exfiltrated 6 terabytes of sensitive data, including health records related to sexual assault, mental health, and other private matters. Despite these claims, AnMed has yet to confirm the extent of the breach, stating that they are still investigating the situation with cybersecurity specialists.

AnMed initially reported a cybersecurity disruption involving malware on July 26 and has since been working to restore its systems. As of now, 10 of its facilities remain closed due to the attack. The Gentlemen, a ransomware-as-a-service group that originated in 2025, has been linked to numerous cyberattacks, with a significant number of targets in industrial sectors. The group's ransomware has affected over 332 victims in the first five months of this year and is known for its sophisticated tactics, which include exploiting vulnerabilities and disabling security tools.

Cybersecurity firm CheckPoint highlights that The Gentlemen's operations are notable for their generous affiliate fee structure, with 90 percent of ransoms going to those who execute the attacks. Meanwhile, Expel has observed the group's advanced methods for disabling endpoint detection and response technology, often using vulnerabilities in third-party systems. AnMed is actively working with Facebook to secure its social media accounts and has disabled access to prevent further unauthorized posts.