AnMed Reports Facebook Account Hijack as The Gentlemen Claims Data Theft
Summary
AnMed says its systems remain disrupted and unauthorized Facebook posts included ransom demands attributed to The Gentlemen. The group claimed to steal 6 terabytes of sensitive health data, but AnMed has not verified the claim and is investigating.
Key points
- AnMed continued to experience widespread disruption two weeks after a malware-related cybersecurity incident.
- AnMed said unauthorized posts appeared on its social media accounts; access through the platform was disabled while it worked to secure the accounts.
- Posts attributed to The Gentlemen demanded a ransom and claimed the group had stolen 6 terabytes of data, including sensitive health information.
- AnMed said the claims were unverified and it had not confirmed whether patient information was affected.
- As of Monday, 10 AnMed facilities remained closed to appointments.
Article Details
- Victim Organization
- AnMed
- Incident Type
- Cyberattack involving malware, ongoing IT disruption, and hijacking of AnMed’s Facebook page to post ransom demands.
- Incident Date
- 2026-07-26
- Data Types Exposed
- The Gentlemen claimed the stolen data included sensitive health information, including records related to sexual assault, mental health, abortions, and sexual harassment; AnMed has not confirmed that patient information was affected.
- Affected Data Size
- The Gentlemen claimed to have exfiltrated 6 terabytes of data; the claim was not verified.
- Operational Impact
- AnMed reported ongoing system disruption and was working to restore systems. As of Monday, 10 facilities remained closed to appointments. AnMed also said unauthorized posts appeared on its social media accounts; it removed the content and disabled access through the platform while working to secure the accounts.
- Ransom Or Extortion
- Ransom demands appeared in unauthorized posts on AnMed’s Facebook page, which were linked to the purported attackers. The Gentlemen claimed data theft, but AnMed said the claims had not been verified.
- Claim Status
- claimed
People
Threat Actors
hastalamuerteThe article says the group is believed to have been founded by a former Qilin affiliate who uses this moniker; it does not establish this person’s involvement in the AnMed incident.The GentlemenThe ransomware group was linked to ransom-demand posts on AnMed’s hijacked Facebook page and claimed to have stolen 6 terabytes of data. AnMed said the claims had not been verified.