2025 Sandhills Medical Foundation — ransomware; ~169k patients notified Apr 2026
Data compromised
Names, dates of birth, Social Security numbers, taxpayer IDs, driver licenses, government IDs, passports, financial information, and protected health information (PHI)
Technical writeup
Sandhills Medical Foundation, Inc., an FQHC serving several South Carolina counties, detected a ransomware attack on May 8, 2025 (with forensics outlining network access roughly May 2-8). The organization mailed notification letters around April 28, 2026, and regulatory filings cited roughly 169,000 affected individuals. SecurityWeek reported that Inc Ransom listed Sandhills in June 2025 and later made allegedly stolen files available for download. Public summaries describe exposed names, dates of birth, government IDs, financial information, and PHI.
Root cause
Ransomware and data exfiltration from healthcare network environments
References
- https://www.sandhillsmedical.org/sandhills-medical-reports-data-security-incident/
- https://www.hipaajournal.com/sandhills-medical-foundation-laurel-eye-clinic-data-breach/
- https://www.securityweek.com/sandhills-medical-says-ransomware-breach-affects-170000/
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e36cacd3-3e26-4bed-be5b-45965f2326cb.html