Sandhills Medical Data Breach
The 2025 Sandhills Medical data breach affected 169,017 people according to the Indiana Attorney General's record. Sandhills Medical's official statement confirms that an unauthorized party obtained personal information belonging to certain patients during a ransomware attack.
Exposed Data Types
2 sensitive9- Medical information
- Health insurance information
- Names
- Dates of birth
- Social security numbers
- Driver's license numbers
- Government issued IDs
- Passport information
- Financial account information
About This Breach
Sandhills Medical Foundation is a healthcare provider in South Carolina. Because identity, financial, and health information may have appeared in the affected files, the incident creates risks of both identity theft and healthcare fraud for affected people.
How Did the Incident Occur?
The Indiana record lists May 2, 2025, as the occurrence date. Sandhills Medical says it discovered the ransomware attack on May 8, secured its network, and began an investigation with cybersecurity specialists, law enforcement, and an independent forensic firm. The investigation found that the attacker directly accessed a server and obtained information belonging to certain patients.
What Information Was Affected?
The information involved varies by person. According to the official statement and the Texas Attorney General's record, it may include names, dates of birth, Social Security numbers, taxpayer identification numbers, driver's license or other government identification information, passport information, financial information, medical information, and health insurance information.
What Did Sandhills Medical Do?
The organization says it secured the network, strengthened its security protocols, and engaged new information-technology partners. Affected people were offered complimentary credit monitoring and fraud-assistance services, with enrollment instructions provided in their notification letters.
What Should Affected People Do?
Notice recipients should check their letters for the enrollment deadline for the complimentary protection service. In addition to reviewing bank and credit activity, they should examine health-insurance statements, patient-portal records, and unfamiliar medical services. People whose Social Security or identification numbers were involved may also consider a fraud alert or credit freeze when appropriate.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
