Sandhills Medical Foundation Class Action Launched, 169K-Patient INC Ransom Breach First Major FQHC Ransomware Litigation of 2026
Issue
South Carolina FQHC Sandhills Medical Foundation (serving Chesterfield, Kershaw, Lancaster, Sumter Counties, SC — primary care, BH, immunizations) faces class action investigation announced May 3, 2026. INC Ransom ransomware group exfiltrated 169,017 patient records May 2-8, 2025; notification letters mailed April 28, 2026.
Data included SSN, ITIN, DL#, passport#, financial info, PHI. CA FQHCs should note this is the largest FQHC ransomware breach reported in 2026 and sets a class-action precedent for safety-net providers — OCR investigation expected to follow given 169K exceeds the 500-patient OCR Breach Portal threshold.
Pairs with Community Health Action Staten Island GENESIS ransomware (60K HIV testing records, Feb 13) and Good Samaritan Health Center Atlanta (10K, Feb 9) — three safety-net clinic ransomware breaches in Q1 2026 establish a clear pattern.
Strategic implication for CA FQHC CISOs/Privacy Officers:
- Cyber insurance limits and ransomware riders need re-audit against 2026 settlement floors
- Class action precedent in SC will inform NY/CA plaintiffs' bar appetite
- HHS OCR's new Health Information Privacy/Data & Cybersecurity Division (May 18) targets exactly this scenario.
Key points
- 169K-patient breach (May 2-8, 2025) — notification April 28, class action May 3
- Largest FQHC ransomware breach of 2026 — sets class-action precedent for safety-net
- 3 safety-net clinic ransomware events Q1 2026 (Sandhills + Staten Island + Good Samaritan)
- Re-audit cyber insurance limits against 2026 settlement floors
Sources for this story
HIPAA Journal / ClassActionLawyers.comSources for your board packet
This story's source plus 4 related stories and their sources, ready to print for your team or board.
Free. Unlocking the packet subscribes you to Intel Brief. You'll be subscribed right away, with no confirmation email. Unsubscribe with one click in any issue. If you unsubscribed before, we won't re-add you. We never sell your email. You can open each source above without an email.
Part of
- Enforcement: privacy, fraud and audits
Data breaches
FQHC Talent. (2026, May 3). Sandhills Medical Foundation Class Action Launched, 169K-Patient INC Ransom Breach First Major FQHC Ransomware Litigation of 2026. Source: HIPAA Journal / ClassActionLawyers.com. Retrieved October 6, 2026, from https://www.fqhctalent.com/intel/sandhills-medical-foundation-169k-breach-class-action-may-3-2026
More in Risk & Compliance
Sep 29
HHS civil rights office says when states can use substance use records
Sep 25
CMS and 37 states pledge to judge Medicaid by health outcomes
Sep 24
Geiger Gibson review finds health centers expect a heavy work-rule frailty burden
Sep 24
CMS seeks input on Part D pharmacy contract terms, including 340B claims