Sandhills Medical Ransomware Leak Exposes 170k Patient Records

South Carolina-based Sandhills Medical Foundation has disclosed a data breach affecting nearly 170,000 individuals. The organisation said in a data security incident notice that it discovered a ransomware attack on 8 May 2025 and has since worked with law enforcement, cybersecurity experts, and a forensics firm to investigate the intrusion and determine its impact.

The hackers obtained the personal information of “select patients,” with the Maine Attorney General’s Office noting that nearly 170,000 people are affected. Compromised data includes names, dates of birth, SSN, Taxpayer Identification Numbers, driver’s licences, government-issued identification, passports, financial information, and personal health information.

The Inc Ransom ransomware group listed Sandhills Medical on its leak website in early June 2025, and the group has since made the allegedly stolen files available for download. The breach was disclosed publicly nearly a year after the initial intrusion.