Sandhills Medical Foundation, Inc., doing business as Sandhills Medical, disclosed a ransomware attack that affected 169,017 individuals. The incident may have exposed sensitive patient information, including Social Security numbers, driver’s license information, dates of birth, government IDs, passports, and personal health information.
Sandhills Medical Foundation’s Data Breach Investigation
Sandhills Medical Foundation, Inc. d/b/a Sandhills Medical (“Sandhills”) recently disclosed a cybersecurity incident involving unauthorized access to its systems. According to the company’s notice, Sandhills discovered on May 8, 2025, that it had been the victim of a ransomware attack.
After discovering the incident, Sandhills stated that it regained control of its secured network and began an investigation with cybersecurity experts, law enforcement, and an independent forensic firm. The investigation determined that an unauthorized third party accessed Sandhills’ server directly and obtained personal information for certain patients.
Regulatory information indicates that the breach occurred on May 2, 2025, and was discovered on May 8, 2025. The incident affected 169,017 individuals, including 39 Maine residents. Consumer notifications were sent on April 28, 2026, with an updated mailing on June 2, 2026.
Sandhills reported that the information involved varied by individual and may have included Social Security numbers, driver’s license information, dates of birth, government-issued identification, passport information, and personal health information. This type of information is especially sensitive because it may be used for identity theft, medical identity theft, insurance fraud, financial fraud, or phishing schemes.
Sandhills stated that it has no evidence that personal information was misused. However, because an unauthorized third party obtained patient information, affected individuals should remain vigilant.
In response, Sandhills enhanced network protocols and security partnerships. The organization is also offering 12 months of credit monitoring services through Cyberscout, a TransUnion company, along with proactive fraud assistance.
When Did This Breach Occur?
According to the breach details:
- Date Breach Occurred: May 2, 2025
- Date Breach Discovered: May 8, 2025
- Consumer Notification Dates: April 28, 2026, and updated mailing June 2, 2026
- Individuals Affected: 169,017
- Maine Residents Affected: 39
- Type of Incident: External system breach / ransomware attack
What Information Was Breached?
The information involved varied by individual and may have included:
- Social Security number
- Driver’s license information
- Date of birth
- Government-issued identification
- Passport information
- Personal health information
Affected individuals should review their notice carefully to determine what information may have been involved.
What You Can Do
If you received a notice from Sandhills Medical, consider taking these steps:
- Enroll in the complimentary credit monitoring services offered through Cyberscout.
- Review credit reports for suspicious activity.
- Monitor medical statements and insurance records for unfamiliar services.
- Place a fraud alert or security freeze with the major credit bureaus.
- Report suspected identity theft to law enforcement and the Federal Trade Commission.
- Keep records of any expenses, suspicious activity, or time spent responding to the breach.
You may also wish to learn whether you have legal options after your personal or health information was exposed.
File a Data Breach Lawsuit Against Sandhills Medical Foundation
If you received a data breach notification from Sandhills Medical Foundation, you may have legal rights. Healthcare organizations are expected to protect sensitive patient information from unauthorized access. When ransomware attackers obtain personal and health information, affected individuals may face long-term risks and costs.
A data breach lawsuit may seek compensation for loss of privacy, identity theft risks, medical identity theft concerns, out-of-pocket expenses, and time spent responding to the breach.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
