DataBreachesDissent
Sandhills Medical breach leaks 169k records via INC Ransom
Part of the Inc story · since 29 Apr
- Wed 29 Apr, 16:11 UTC. DataBreaches, first report. Sandhills Medical breach leaks 169k records via INC Ransom. This article, 1st of 12.
- Wed 17 Jun, 20:48 UTC. Dark Reading, its first report on the story. INC ransomware hits over 800 victims, targets healthcare sector.
- Thu 18 Jun, 15:10 UTC. The Hacker News, its first report on the story. INC ransomware jumps as RaaS threat, over 830 victims since 2023.
- Thu 2 Jul, 09:21 UTC. The Hacker News. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge.
- Thu 2 Jul, 11:11 UTC. Security Affairs, its first report on the story. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices.
- Thu 2 Jul, 20:12 UTC. Dark Reading. FortiBleed breach fuels ransomware risk for Inc and Lynx gangs.
- Fri 17 Jul, 21:01 UTC. Dark Reading. SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs. Cites a CVE in CISA KEV.
- Wed 9 Sep, 12:26 UTC. DataBreaches. New Jersey School District Network Outage Linked to Ransomware Attack.
- Tue 20 Oct, 10:43 UTC. SecurityOnline, its first report on the story. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
- Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
- Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
- Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
Sandhills Medical Foundation in South Carolina notified the Maine Attorney General’s Office on 28 April 2026 that 169,017 people were affected by a data breach, with only eight being Maine residents. According to their notification to those affected, on 8 May 2025 they discovered they had been the victim of a ransomware attack that began on 2 May 2025.
Their letter does not reveal that the attack was by INC Ransom, and INC Ransom’s listing, posted by 3 June 2025, shows no encryption; according to INC Ransom’s listing, there was no lock icon indicating an encryption incident. The data tranche reportedly included personal information for select patients, and INC Ransom claimed responsibility for the attack and subsequently leaked the data on or after 15 June 2025.
Sandhills’ letter states that a forensic review determined an unauthorized third party accessed the server and obtained personal information, prompting an extensive data mining process to determine impacted individuals. As of 29 April 2026, the listing remains online and the data tranche remains available.
How the story developed
12 articles from 5 outlets since 29 Apr. Quiet since 23 Oct. This was the first report.
- Wed 29 Apr, 16:11 UTC. DataBreaches, first report. Sandhills Medical breach leaks 169k records via INC Ransom. This article, 1st of 12.
- Wed 17 Jun, 20:48 UTC. Dark Reading, its first report on the story. INC ransomware hits over 800 victims, targets healthcare sector.
- Thu 18 Jun, 15:10 UTC. The Hacker News, its first report on the story. INC ransomware jumps as RaaS threat, over 830 victims since 2023.
- Thu 2 Jul, 09:21 UTC. The Hacker News. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge.
- Thu 2 Jul, 11:11 UTC. Security Affairs, its first report on the story. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices.
- Thu 2 Jul, 20:12 UTC. Dark Reading. FortiBleed breach fuels ransomware risk for Inc and Lynx gangs.
- Fri 17 Jul, 21:01 UTC. Dark Reading. SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs. Cites a CVE in CISA KEV.
- Wed 9 Sep, 12:26 UTC. DataBreaches. New Jersey School District Network Outage Linked to Ransomware Attack.
- Tue 20 Oct, 10:43 UTC. SecurityOnline, its first report on the story. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
- Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
- Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
- Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 12 articles as a listHide the list
- Wed 29 AprDay 01
- Sandhills Medical breach leaks 169k records via INC Ransom16:11 · DataBreaches · First report · This article, 1st of 12
Quiet for 7 weeks
Wed 17 JunDay 491- INC ransomware hits over 800 victims, targets healthcare sector20:48 · Dark Reading · Picked up again
- Thu 18 JunDay 501
- INC ransomware jumps as RaaS threat, over 830 victims since 202315:10 · The Hacker News
Quiet for 2 weeks
Thu 2 JulDay 643- FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge09:21 · The Hacker News · Picked up again
- FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices11:11 · Security Affairs
- FortiBleed breach fuels ransomware risk for Inc and Lynx gangs20:12 · Dark Reading
Quiet for 2 weeks
Fri 17 JulDay 791- SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs21:01 · Dark Reading · Exploited CVE · Picked up again · Known exploited CVE
Quiet for 8 weeks
Wed 9 SepDay 1331- New Jersey School District Network Outage Linked to Ransomware Attack12:26 · DataBreaches · Picked up again
Quiet for 6 weeks
Tue 20 OctDay 1743- Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-025710:43 · SecurityOnline · Picked up again · Known exploited CVE
- Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA16:13 · The Hacker News · Known exploited CVE
- Ransomware gangs exploit patched Palo Alto VPN security flaw16:48 · DataBreaches · Known exploited CVE
Quiet for 3 days
Fri 23 OctDay 1771- AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices18:36 · The Hacker News · Picked up again · Known exploited CVE