Sandhills Medical Foundation (SC) Community Health Center Breach (2025): 169K Patient Records Including SSN & Medical Data Exposed via INC Ransom

About Sandhills Medical Foundation

Sandhills Medical Foundation is a nonprofit federally qualified health center (FQHC) providing primary and preventive care across Chesterfield, Kershaw, Lancaster, and Sumter Counties in South Carolina, largely serving rural and underserved populations. It maintains patient identity, insurance, billing, and clinical records.

Why They Hold Your Data

Regional healthcare organizations collect patient identity, insurance, billing, treatment, and administrative records across community care operations.

Recent Developments

A ransomware attack by the INC Ransom group compromised Sandhills’ network in early May 2025 (access ~May 2-8, detected May 8 when files were encrypted). INC Ransom listed Sandhills on May 30, 2025 and leaked the stolen data on June 15, 2026 after the ransom went unpaid. Sandhills notified 169,017 individuals around April 28, 2026; class-action investigations followed.

Data Points Exposed

Breach Impact

The exposure of Social Security numbers, dates of birth, driver's license/government IDs, and health information for over 169,000 patients, later fully leaked by INC Ransom, creates severe identity-theft, medical-fraud, and insurance-abuse risk. As an FQHC serving rural, underserved communities, affected patients may have fewer resources to detect and recover from fraud, and the delayed notification widened the exposure window.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using SSN, DOB, and driver's license | • Medical identity fraud and insurance abuse using health data | • Targeted phishing and vishing referencing clinic care or billing | • Doxxing and physical targeting from exposed home addresses | • Heightened harm to rural/underserved patients with fewer recovery resources

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
4. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
5. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).