Sandhills Medical Foundation yesterday confirmed it notified 169,017 people of a May 2025 data breach that compromised the following personal info:
- Names
- Social Security numbers
- Taxpayer ID numbers
- Government-issued IDs (e.g. driver’s license, passport)
- Financial info
- Personal health info
- Dates of birth
The South Carolina chain of medical clinics on May 8, 2025 announced it was “experiencing system disruptions due to a vendor-related technical issue.” The attack affected Sandhills’ phones, appointment scheduling and other services, according to a social media post.
A ransomware group called Inc took credit for the breach on May 30, 2025.
Sandhills Medical Foundation has not acknowledged Inc’s claim and Comparitech cannot independently verify it. Sandhills told Comparitech that it did not pay a ransom, but it declined to answer questions about how attackers breached its network and how much Inc demanded.
“On May 8, 2025, Sandhills discovered we were the victim of a ransomware attack,” says Sandhill’s notice to breach victims.
“It was not until the forensic firm completed their review of our system that we knew
the general scope of information involved in the incident. That investigation determined an unauthorized third party accessed our server directly and obtained personal information for select patients.”
Sandhills is offering breach victims 12 months of free credit monitoring and fraud assistance through TransUnion. The deadline to enroll is 90 days from the date on the notice letter.
Who is Inc?
Inc is a ransomware group that first surfaced in July 2023 and targets a wide range of victims in healthcare, education, and government. Its methods involve spear phishing and exploiting known vulnerabilities in software. Once infected, Inc’s malware both steals data and locks down computer systems until a ransom is paid to unlock them.
In 2025, Inc claimed responsibility for 361 ransomware attacks. Of those, 77 were confirmed by the organizations it targeted.
22 of those 77 confirmed attacks hit healthcare providers. The attack on Sandhills was Inc’s biggest by number of records affected, followed by:
- Southern Connecticut Vascular Center notified 154,417 people of a May 2025 data breach claimed by Inc
- Persante Health Care notified 111,815 people of a January 2025 data breach claimed by Inc
In 2026 to date, Inc has taken credit for 170 more attacks, 18 of which have been confirmed. Two of those confirmed attacks hit healthcare providers:
- Lymphedema Therapy Specialists reported a February 2026 data breach
- Bendigo & District Aboriginal Co-operative, Australia reported an April 2026 data breach
Ransomware attacks on US healthcare
Comparitech researchers logged 136 confirmed ransomware attacks on US hospitals, clinics, and other healthcare providers in 2025. Those attacks compromised more than 12 million records in total. Inc’s attack on Sandhills is the 14th-largest by number of records affected.
In 2026, we’ve confirmed 10 such attacks so far. Some recent examples include:
- Kettering Health notified 1.7 million people of a May 2025 data breach claimed by Interlock
- Southern Illinois Dermatology notified 160,312 people of a November 2025 data breach claimed by Insomnia
- Heart South Cardiovascular Group notified 46,666 people of a November 2025 data breach claimed by Rhysida
- Rocky Mountain Associated Physicians notified 50,640 people of an October 2025 data breach claimed by PEAR
Ransomware attacks on US hospitals, clinics, and other care providers can steal data and lock down infected computer systems. They can cripple critical systems and endanger the health, privacy, and security of patients. Infected hospitals and clinics must pay a ransom or face extended downtime, data loss, and putting patients and staff at increased risk. Hospitals and clinics might resort to pen and paper, cancel appointments, and divert patients elsewhere until systems are restored.
About Sandhills Medical Foundation
Founded in 1977, Sandhills Medical operates 10 primary health clinics in South Carolina. They are located in Bethune, Camden, Jefferson, Kershaw, Lugoff, McBee, Pageland, Ruby, and Sumter.
