Sandhills Medical Foundation, Inc., d/b/a Sandhills Medical, has notified a select group of patients of a cybersecurity incident in which some of their personal information was accessed by an unauthorized third party. In addition to taking comprehensive steps to secure and enhance its information technology systems to prevent similar incidents in the future, Sandhills is providing all affected individuals with access to credit monitoring and proactive fraud assistance services at no charge.
“We take our information security extremely seriously and have responded to this attack with fully updated IT safeguards and protocols,” said Amanda Duke, CEO of Sandhills Medical. “We sincerely regret any concern this incident caused and remain committed to providing quality, comprehensive, accessible care to the patients and families we serve.”
What happened
On May 8, 2025, Sandhills discovered it was the victim of a ransomware attack. It immediately regained its secured network and began an investigation with the help of cybersecurity experts, law enforcement and an independent forensic firm. It was not until the forensic firm completed their review of the system that Sandhills knew the general scope of the information involved in the incident. That investigation determined an unauthorized third party accessed its server directly and obtained personal information for select patients.
From there, Sandhills began an extensive data mining process to determine which individuals were affected by the incident. Those individuals were notified directly via U.S. mail.
Affected information varied by individual and may have included one or more of the following: date of birth, Social Security number, Individual Taxpayer Identification Number, driver’s license, government issued identification, passport, financial information and personal health information.
What Sandhills is doing
Upon discovering the breach, Sandhills immediately secured its network. Since that time, it has enhanced its network protocols and engaged new information technology partners to further enhance security and protect against similar incidents in the future.
Additionally, in response to the incident, Sandhills is providing affected individuals with access to credit monitoring and proactive fraud assistance services at no charge. Information on how individuals can access these services is detailed in the notification letter.
Questions?
Representatives are available to assist you with questions regarding this incident, between the hours of 8:00 a.m. to 8:00 p.m. Eastern time, Monday through Friday, excluding holidays. Please call the help line at 1-833-877-9639 and supply the fraud specialist with the unique code listed in your notification letter.