Sandhills Medical Foundation data breach: a May 2025 ransomware attack and 169,017 patients

Was Sandhills Medical hit by ransomware?

Yes, in its own words. The letter says Sandhills found on May 8, 2025 that it was the victim of a ransomware attack, regained its network and investigated with cybersecurity experts, law enforcement and an independent forensic firm. HIPAA Journal reports that the INC Ransom group claimed the attack and listed Sandhills on its dark web leak site on May 30, 2025, and that the group later leaked the stolen data, a sign the ransom was not paid. The letter does not name a group or mention a demand.

HIPAA Journal also reports that the forensic review found the intruders had been in the network from May 2 to May 8, 2025, that files were encrypted when the attack was found, and that files were taken during that week. Indiana's record gives May 2, 2025 as the breach date, which matches.

What happened, and when?

Date	What happened	Source
May 2, 2025	Start of access; Indiana's breach date	Indiana record; HIPAA Journal
May 8, 2025	Ransomware discovered	Letter
May 30, 2025	INC Ransom lists Sandhills on its leak site, per HIPAA Journal	HIPAA Journal
September 14, 2025	Report to HHS (169,017)	HHS portal
April 28, 2026	Letters dated; Indiana's notice date	Letter; Indiana record
June 2, 2026	Texas publishes the report (328 Texans)	Texas record

The letter explains the wait: it was not until the forensic firm finished its review that Sandhills knew the general scope, and it then ran what it calls an extensive data mining process to find out which people were affected. From discovery to letters took 355 days. The notice-delay guide shows where that sits among the notices in this log.

What information was involved in the Sandhills Medical breach?

The letter itself is brief: the information varied by person and may have included personal health information and date of birth. The report Sandhills filed with Texas is fuller. It lists name, Social Security number, driver's license number, government-issued ID number, medical information, health insurance information and date of birth. The same record gives McBee, South Carolina as the organization's city and says notice went out by mail, on a website and in print media.

How many people were affected by the Sandhills Medical Foundation breach?

169,017 people, in both the federal and Indiana records.

Record	What it counts	Number
HHS Office for Civil Rights	People affected	169,017
Indiana attorney general	People affected in total	169,017
Texas attorney general	Texans	328
Indiana attorney general	Indiana residents	86

HIPAA Journal describes Sandhills as a federally qualified health center serving Chesterfield, Kershaw, Lancaster and Sumter counties. Its total is one of the larger ones in Indiana's 2026 report, where 47 notices give a larger total.

What is Sandhills offering people who got a letter?

Twelve months of credit monitoring and proactive fraud assistance from Cyberscout, a TransUnion company, at no charge.

Item	Detail from the letter
Service	Credit monitoring with alerts for 12 months from enrollment, plus fraud assistance
Provider	Cyberscout, a TransUnion company
Enrollment	https://bfs.cyberscout.com/activate, with the code on the letter, within 90 days of the letter's date
Help line	Representatives available for 90 days from the letter's date

Because the enrollment window was 90 days from April 28, 2026, a code from these letters no longer works. The guide to credit monitoring offers lists the free steps anyone can still take, and the guide to healthcare provider breach notices compares other clinics' letters.

Was my information in the Sandhills Medical data breach?

If you got a letter from Sandhills Medical dated April 28, 2026, your information was in the files. If you were a patient and did not, Sandhills may not have had a current address; it also gave notice on a website and in print. With the stolen data reported as leaked, a credit freeze with the three bureaus is a free step anyone can still take.

What the documents leave open

• How the attackers got into the network.
• Why the HHS report came in September 2025 but the letters not until April 2026.
• Whether the data posted by the group matches what the letter describes.