Sandhills Center

Sandhills Center operates as a public mental health service provider in North Carolina, managing behavioral health programs and delivering clinical services to residents across the region. Its core functions include conducting psychiatric evaluations, offering outpatient treatment, coordinating case management, and providing crisis intervention for individuals with mental health conditions. As a mental health services manager, the organization works to integrate care across various community settings and to ensure access to state‑funded mental health resources.

The organization serves a substantial population, with incident reports indicating that personal data belonging to over 42,600 individuals from multiple counties was present in its systems. This figure reflects the breadth of its client base and the geographic reach of its services throughout North Carolina. While the exact number of facilities or staff members is not disclosed in the available sources, the scale of the data breach underscores the organization’s role as a significant handler of sensitive health information within the state.

Sandhills Center’s distinguishing attributes lie in its specialization in public sector mental health care and its responsibility for safeguarding confidential identifiers such as Social Security and Medicaid numbers. The entity functions under state oversight, which places it within a regulatory framework designed to protect patient privacy and ensure quality of care. Its handling of decades‑old records, as highlighted in the 2021 cyber incident, demonstrates both the depth of its historical data archives and the challenges associated with managing long‑term client information.

Ownership and parent‑subsidiary relationships are not explicitly detailed in the provided material, so no definitive statements can be made about its corporate structure. The organization is identified as a North Carolina mental health service provider, implying a public or governmental affiliation, but further specifics remain unspecified in the sources consulted.

In July 2021, Sandhills Center experienced a notable cybersecurity breach in which threat actors allegedly exfiltrated 634 GB of data, including outdated student evaluations and demographic information, and attempted to auction the stolen material on a hacking forum. The incident exposed potential vulnerabilities in the organization’s data protection practices and prompted concerns about notification obligations, especially given the age of some of the compromised records. Despite the severity of the breach, the organization reportedly did not respond to inquiries from media or oversight bodies at the time of the initial reporting. This episode remains a significant event in the organization’s recent history, highlighting the intersection of mental health service delivery and cybersecurity risk.