BreachPublished 30 Apr 2026

Sandhills Medical Says Ransomware Breach Affects 170,000

Source SecurityWeek

Description

Sandhills Medical Foundation, a healthcare provider based in South Carolina, disclosed a ransomware attack that occurred on May 8, 2025, but only publicly revealed the breach nearly one year later. The ransomware group Inc Ransom targeted the organization, obtaining personal information of approximately 170,000 individuals, including sensitive data such as names, dates of birth, Social Security numbers, taxpayer IDs, government-issued IDs, financial information, and personal health information. The attackers listed Sandhills Medical on their leak site and made stolen files available for download. The organization has been cooperating with law enforcement and cybersecurity experts to investigate the incident. No specific technical vulnerability or exploit details are provided, and there is no indication of a patch or remediation status.

Impact

The breach compromised sensitive personal and health information of approximately 170,000 individuals, including names, dates of birth, Social Security numbers, taxpayer identification numbers, government-issued IDs, financial data, and personal health information. This exposure can lead to identity theft, financial fraud, and privacy violations for affected individuals. The delayed public disclosure may have impacted timely mitigation by those affected. The ransomware attack disrupted the healthcare provider's operations and resulted in data leakage on a criminal leak site.

Defensive guidance

The healthcare organization has been working with law enforcement, cybersecurity experts, and forensic firms to investigate and respond to the breach. Organizations should ensure robust ransomware defenses, incident response plans, and timely breach disclosures. Affected individuals should be notified and offered appropriate identity protection services. Since this is a ransomware incident rather than a software vulnerability, standard patching guidance does not apply.

Summary

Sandhills Medical Foundation experienced a ransomware attack by the Inc Ransom group on May 8, 2025, which resulted in unauthorized access to sensitive personal and health information of about 170,000 individuals. The breach was publicly disclosed nearly a year later. The attackers published stolen data on their leak site. The healthcare provider has engaged law enforcement and forensic experts to assess the impact. There is no information about a specific exploited vulnerability or available patch. The incident highlights risks associated with ransomware attacks on healthcare organizations and the exposure of sensitive patient data.

References

securityweek.com/sandhills-medical-says-ransomware-breach-affects-170000/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Apr 2026, 08:36 UTC

References

Community reviews