By Bru Nimmons
Staff Reporter
bnimmons@thepccourier.com

COUNTY — Followers of AnMed’s Facebook page were met with a sinister message on Tuesday morning as the health care provider continues to try to recover from a cyberattack that began on July 26.

At around 9:40 a.m. Tuesday, a message claiming that sensitive, confidential data had been breached and would be shared unless the poster received payment. Accompanying the post was an image of a man in a top hat and mustache labeled, “The Gentlemen.”

The full message read, “Gentlemen, your confidential data has been exfiltrated. We have full access to your corporate network and have extracted all critical information — 6 terabytes. Patient records containing DOB, SSN, addresses, medical histories, prescriptions ,laboratory results, and detailed medical files1Mental and behavioral health records, suicide attempts and ideation databases, pediatric and psychiatric reports HIV-related data, reproductive and abortion records, prenatal and NIPT testing Genetic and molecular pathology data (DNA information)Biometric data, identification documents, forensic and autopsy records Sexual assault, harassment, and rape victim records base of the patients with DOB, SSN, home addresses and some medical info.- HIV-positive pregnant women’s list- Data base of the cancer diagnosis – Confidential papers about the abortions and reproductive health- Fingerprint reports and scans- Mental health data bases – Drug and alcohol tests and reports- Hundreds of prenatal and NIPT (Non-Invasive Prenatal Testing)- prescriptions’s data – personal ID cards, passports, SSNs and DL- detailed medical records- data base of the mental and behavoral health patients — Data base of all registered suicide atempts with details – Genetic markers and notes – Full data base of the mental and behavoral health patients – Data base of the forecnic reports – HIV-positive data base (medication and treatment details) – Abortions data base- Sexual harassment incidents registered in details – Testimonies of rape victims and the gallery from the Police departement- sexual assault pictures and charts , including intimate details and foto- autopsy’s reports and pictures, including criminal case related We guarantee complete data deletion and confidentiality in the event of cooperation and payment within the deadline. To verify that we possess your data, you may request samples of specific files — we will provide them immediately.”

Following the posts, the AnMed Facebook page was taken down and remained offline at press time.

AnMed confirmed its account had been compromised on Tuesday afternoon.

“Earlier today, AnMed identified unauthorized posts on its social media accounts. The unauthorized content was removed, access through the platform was disabled and we are working with the provider to secure the accounts,” a news release said.

AnMed officials are continuing to monitor the situation, according to the release, and reassured the public that the claims made in the post have not been verified.

“The claims contained in the posts have not been verified,” the release said. “AnMed and its cybersecurity specialists are investigating the matter as part of the organization’s ongoing response to the cybersecurity incident identified on July 26. If the investigation determines personal information was affected, AnMed will provide appropriate notifications and additional information as it becomes available.”

AnMed reaches key system restoration milestones

While public concern was raised by the nature of the removed Facebook post, AnMed was able to provide good news on Tuesday as officials said the company is continuing to restore access to systems that were affected by the cyberattack.

“AnMed continues to make significant progress in restoring its systems and communications following the cybersecurity incident identified on July 26,” the release said. “Care teams now have full read/write access to patients’ electronic health records, allowing them to view and electronically update medical records.”

Beginning at 7 a.m. Wednesday, AnMed patients can once again call their doctors’ offices and other departments directly during regular service hours with questions regarding their care.

The investigation remains ongoing and AnMed will share additional information as it becomes available.

“We are grateful for the continued patience, understanding and support of our patients, team members and community partners as we work to safely and fully restore our systems and communications,” the news release said.

Visit anmed.org/latest-updates for updates.