Malware knocked out phones and internet at the AnMed health system

A malware attack knocked out the phone and internet systems at AnMed, a health system operating in South Carolina and Georgia, the local TV station WYFF reported on 26 July 2026. Some AnMed Medical Group offices and imaging services were closed, and elective procedures are being rescheduled. According to the coverage, AnMed is working with cybersecurity specialists and authorities to restore the systems.

What happens technically

The coverage does not state what type of malware is involved, how it got in, or whether patient data is affected. It is therefore unknown whether this is a ransomware attack, even though the outcome resembles one. What is known is the effect: telephony and internet failed at the same time, and parts of clinical operations had to close. That a malware attack hits the phones as hard as the computer systems is not surprising in modern infrastructure. Corporate telephony today usually runs over the same IP network as all other traffic, and when the network goes, the voice channel goes with it.

At the same time, systems are often shut down deliberately during incident response. Disconnecting networks and services is an established move to prevent further spread while the scope is mapped, and an outage can therefore be part of the response just as well as part of the attack. The coverage does not distinguish between the two in this case. The consequence for patients is the same either way: closed offices, postponed procedures and a health system that must run on paper and fallback arrangements until the systems return.

What this means for you if you own the continuity plan

The attack is a reminder that availability is a security property on par with confidentiality. For a hospital, the telephone is part of patient safety. If you carry the continuity plan somewhere else, it is a precondition for customer contact, on-call arrangements and alerting. When both telephony and internet share the fate of the computer systems, the continuity plan must answer an uncomfortable question: how do we reach each other, our customers and the emergency services on the day everything IP-based disappears at once?

Health is one of the sectors of high criticality in the NIS2 directive. In the EU, hospitals and private clinics are as a rule covered when they are medium-sized or larger, and the large ones count as essential entities. An operations supplier is not brought into scope of NIS2 merely by supplying a hospital or clinic. A customer covered by NIS2 must address security in its relationships with its direct suppliers, so the requirements reach the operations supplier through the contract. Manual fallback routines, alternative communication channels and exercises where the systems are actually unavailable are what decide whether an attack becomes a disruption or a crisis. Plans that have never been rehearsed without system support are in practice not plans.

Berigo recommends

• Map which critical functions share infrastructure with the IP network, telephony included, and what actually remains when the network is down.
• Establish alternative communication channels for crisis situations, and make sure they work independently of your own network.
• Prepare manual fallback routines for the most important processes, and rehearse them while the systems are deliberately switched off.
• Clarify in advance who decides on shutdown and disconnection during an incident, and who notifies customers and authorities.
• Test recovery plans against a scenario where both telephony and internet are gone at the same time.