Ransomware group hijacks hospital system’s Facebook page amid ongoing cyberattack fallout
'The Gentlemen' ransomware group hijacked AnMed's Facebook page, claiming theft of 6TB of sensitive patient data during an ongoing cyberattack on the hospital system.
AnMed, a nonprofit medical system with four hospitals in Georgia and South Carolina, is still responding to a July 26 cyberattack involving malware, with 10 facilities remaining closed as of Monday. On Tuesday its Facebook page displayed unauthorized posts claiming 'The Gentlemen' ransomware group exfiltrated 6 terabytes of data, including records on sexual assault, mental health, abortions and harassment; AnMed said the claims are unverified and patient data impact has not been confirmed. The Gentlemen, believed founded by a former Qilin affiliate using the moniker 'hastalamuerte,' extorted 332 victims in the first five months of 2026 per CheckPoint and claimed 125 industrial attacks in Q2 2026 per Dragos. The group typically breaches networks through edge devices, credential brute-forcing and known vulnerabilities, and offers affiliates tools to disable EDR.
- AnMed's Facebook page showed ransom demands from 'The Gentlemen' group.
- Hackers claim 6TB exfiltrated; AnMed has not verified patient data impact.
- 10 facilities remained closed two weeks after the July 26 incident.
- The Gentlemen extorted 332 victims in five months, per CheckPoint.
- Group gains access via edge devices, brute-forcing and known vulnerabilities.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110.001 Password GuessingT1562.001 Impair Defenses: Disable or Modify ToolsT1486 Data Encrypted for Impact
- Vendors
- AnMedCheckPointExpelDragos
- Products
- Threat actors
- The GentlemenQilin
- Victims
- AnMed
- Countries
- United States
From the original article
2 min read at therecord.media
Two weeks after a cyberattack knocked out its IT systems , the nonprofit medical system AnMed is still facing closures and the apparent hack of its Facebook page, which on Tuesday began showing ransom demands from the purported hackers.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.