Sandhills Medical Ransomware Attack Affects 170,000 Patients

Sandhills Medical Foundation, Inc. disclosed a May 2025 ransomware attack on April 30, 2026, nearly a year after discovering encrypted files, affecting approximately 170,000 patients (or 169,017 individuals per HIPAA Journal). This significant delay highlights the protracted investigations common in healthcare breaches, often leaving affected individuals in the dark for extended periods.

What Happened

On May 8, 2025, Sandhills Medical Foundation, a federally qualified community health center serving several counties in South Carolina, detected a ransomware attack encrypting files on their network. Forensic analysis later determined that the threat actors had maintained access to the network for a full week, from May 2, 2025, to the discovery date, May 8, 2025. The organization initiated an immediate investigation, engaging law enforcement, external cybersecurity experts, and a dedicated forensics firm to understand the scope and impact of the intrusion, as reported by SecurityWeek. The formal public disclosure of the incident didn’t occur until April 30, 2026, nearly a year after the initial discovery.

Why It Matters

This incident directly impacted approximately 170,000 patients, exposing sensitive data including names, dates of birth, and personal health information (PHI) for a subset of those individuals. The healthcare sector remains a prime target for ransomware attacks due to the critical nature of its services and the high value of patient data on illicit markets. The long lead time between discovery and public notification, nearly a year in this case, means individuals potentially had their PHI compromised for an extended period without their knowledge, delaying their ability to take protective measures. This extended timeline underscores the complexity of incident response in highly regulated environments like healthcare. Organizations often need to meticulously reconstruct events and verify all affected data before formal disclosure, which can be a lengthy process.

Technical Breakdown

While the specific ransomware strain wasn’t disclosed, the attack followed a common playbook, with threat actors gaining network access and then deploying ransomware to encrypt files. The window of network access, from May 2, 2025, to May 8, 2025, suggests a structured campaign, likely involving initial reconnaissance, privilege escalation, and lateral movement before the final payload deployment. Many ransomware operations, like the Pandora strain observed in 2022, leverage double extortion tactics, exfiltrating data before encryption to add leverage for ransom payment. This tactic aligns with the reported data breach alongside the encryption event.

Imagine an attacker gaining access to your network through a single exposed service – perhaps an unpatched RDP server. They then quietly move through your network, mapping out critical systems and identifying high-value data. This is akin to a burglar first picking a lock, then silently navigating a house for days, understanding its layout and where valuables are kept, before finally making off with the goods. The prolonged access window before encryption is a hallmark of such methodical infiltration.

This incident likely involved TTPs such as T1190 Exploit Public-Facing Application for initial access, potentially followed by T1078 Valid Accounts for persistent access and T1021.001 Remote Desktop Protocol for lateral movement. The exfiltration of PHI points to T1041 Exfiltration Over C2 Channel or T1567 Exfiltration Over Web Service, depending on the chosen egress vector. Finally, the encryption itself is categorized as T1486 Data Encrypted for Impact, often paired with T1490 Inhibit System Recovery by deleting backups or shadow copies. Implementing robust access controls, continuous monitoring, and secure remote access solutions like Cloudflare Zero Trust are crucial for mitigating these TTPs.

From a compliance perspective, the prolonged investigation and disclosure period put significant pressure on IR-6 Incident Reporting requirements. Furthermore, the incident highlights weaknesses in SC-7 Boundary Protection and AU-2 Event Logging, suggesting that initial intrusion indicators might have been missed or lacked sufficient context for rapid response. Effective implementation of RA-5 Vulnerability Monitoring and Scanning could have identified the initial access vector sooner.

Historical Context

The Sandhills Medical Foundation incident echoes the May 2021 ransomware attack on Colonial Pipeline, which saw a critical infrastructure provider shut down operations, causing widespread fuel shortages. Both incidents underscore the devastating operational and reputational impact of ransomware, although Colonial Pipeline’s immediate operational disruption was arguably more acute. In both cases, sensitive data was either threatened or confirmed exfiltrated. The Colonial Pipeline attack, attributed to DarkSide, was notable for its rapid impact and the subsequent FBI recovery of a portion of the ransom payment. While the Sandhills attack didn’t shut down critical infrastructure on a national scale, it mirrors the trend of threat actors targeting organizations with high-value data and operational dependencies, demonstrating the persistent and evolving nature of ransomware as a threat.

Data at a Glance

Our Take

The nearly year-long gap between detection and public disclosure at Sandhills Medical Foundation is concerning, but not entirely surprising given the complexities of forensic investigation, legal counsel, and regulatory compliance in healthcare. We often see organizations struggle with the sheer volume of data involved in a breach and the meticulous effort required to accurately identify all affected individuals and data points. While understandable, this delay puts patients at an increased risk for identity theft or targeted phishing attacks, and underscores the need for more streamlined incident response frameworks, perhaps leveraging automated breach notification tools.

The CVEDaily Take

This incident is a stark reminder that robust backup and recovery strategies are as critical as ever, even with advanced EDR/XDR solutions. While CrowdStrike Falcon or SentinelOne excel at endpoint protection, an air-gapped, immutable backup solution like Veeam or Acronis is the last line of defense against data destruction for impact. Have you recently tested your organization’s data recovery capabilities against a full-scale ransomware simulation?

FAQ

Q: What type of information was exposed in the Sandhills Medical Foundation breach?
A: The breach exposed patient names, dates of birth, and personal health information (PHI) for a subset of the affected individuals, according to reports from HIPAA Journal.

Q: Why did it take nearly a year for Sandhills Medical Foundation to disclose the ransomware attack?
A: The delayed disclosure, from the May 8, 2025, discovery to the April 30, 2026, public notification, is likely due to the extensive investigation process required to determine the full scope of the breach, identify affected individuals, and comply with regulatory requirements, as suggested by similar incidents in the healthcare sector.

Q: What steps can organizations take to prevent similar ransomware attacks?
A: Cybersecurity experts consistently recommend maintaining up-to-date operating systems and software, enforcing least privilege with solutions like Bitwarden for credential management, maintaining offline and immutable backups, and continuous monitoring for early warning indicators of compromise to detect and respond to threats like the Sandhills Medical Foundation incident.