Article
The latest warning
On Aug. 10, U.S. and international agencies issued a joint advisory on Gunra, a ransomware-as-a-service operation that first appeared in 2025. The group has hit government, critical infrastructure and health care targets. Like many current gangs, it uses double extortion: it encrypts systems and threatens to post stolen data on a leak site unless a ransom is paid. The advisory includes detection and mitigation guidance, and the AHA flagged it for hospitals.
Days later, AHA’s Rick Pollack wrote that attacks on hospitals are growing in frequency and sophistication, that vendors and supply chain partners are frequent entry points, and that these incidents should be treated as threats to patient safety, not routine IT problems.
What a long recovery looks like
The experience of AnMed in Anderson, S.C., illustrates the stakes. After a malware attack on July 26, the system initially closed 83 facilities and took its patient portal and other systems offline. By Aug. 5, it had reopened most sites, but 10 locations, including several outpatient imaging centers, remained closed. Emergency and urgent care stayed open, and clinicians worked with limited access to records and prescribing under downtime procedures. Patients also reported suspicious appointment reminders that appeared to come from the system.
AnMed is not alone. Healthcare Dive noted that the University of Mississippi Medical Center took more than a week to reopen clinics after a February attack, and that Signature Healthcare in Massachusetts diverted ambulances after an April incident. Security advisers quoted in that coverage said slow restoration is sometimes deliberate to avoid reinfection, but that long outages also point to gaps in backups and incident response testing.
Questions for the executive team
- How long can we run on paper? Most downtime plans assume hours or a few days. Test a scenario of two weeks or more, including staffing, pharmacy, lab and imaging.
- Which services close first? Decide in advance which outpatient sites would close and how patients would be redirected, so the decision is not made under pressure.
- Are backups isolated and tested? Confirm that recovery copies are offline or immutable and that restoration has been timed, not just assumed.
- How will we talk to patients? Prepare messages warning patients about fake portal notices and phishing during an outage.
- What do vendors owe us? Review contracts for notification, recovery support and liability terms.
Archive entry for Aug 15, 2026, added Nov. 11, 2026.