Sandhills Medical Foundation

Sandhills Medical Foundation is a medical foundation headquartered in the United States that delivers healthcare services and maintains patient health records. As part of its operations the organization collects, stores, and processes protected health information, which includes names, dates of birth, Social Security numbers, taxpayer identification numbers, driver’s licenses, government‑issued identification, passports, financial details, and medical data. The foundation serves individuals seeking medical care, likely through clinics or affiliated health facilities that generate the personal and clinical data it handles. Because it manages such sensitive information, it is subject to federal health privacy regulations and must implement safeguards to protect the confidentiality, integrity, and availability of patient data. The nature of the data it oversees makes it a target for cyber threats that seek to exploit personal and health information for fraudulent or malicious purposes.

In May 2025 the foundation disclosed a ransomware attack attributed to the Inc Ransom group that exposed the personal data of nearly 170,000 individuals, including the full range of identifiers and protected health information noted above. The attackers posted the stolen data on a leak site and made it available for download, prompting the organization to engage law enforcement, cybersecurity experts, and a forensics firm to investigate the intrusion and notify affected parties. A prior incident in September 2020 involved a vendor that provided electronic data storage services for the foundation; attackers used stolen credentials to infiltrate the vendor’s systems and exfiltrated patient names, dates of birth, contact details, government‑issued identifiers, and claims data that could reveal medical diagnoses. Although medical records and direct financial data were reported as unaffected in the 2020 event, the breach still necessitated notification of regulatory bodies and impacted individuals, who were offered complimentary credit monitoring and identity‑theft protection services. The vendor responded to the 2020 attack by paying the ransom demand to recover the data, subsequently implementing enhanced security controls and cooperating with law enforcement and cybersecurity investigators. These two episodes illustrate the foundation’s responsibility for large volumes of confidential health and personal information and highlight the ongoing challenges healthcare organizations face in defending against ransomware and credential‑based attacks. The foundation’s response pattern—coordinating with external authorities, employing forensic analysis, and undertaking patient notification—demonstrates a structured approach to incident management. No explicit information regarding parent companies, subsidiaries, or ownership structure is available in the provided sources, indicating that Sandhills Medical Foundation operates as an independent entity under its stated name.