Dillon Family Medicine Data Breach: PHI and PII Compromised

Dillon Family Medicine, a medical practice operating as part of McLeod Health in Dillon, South Carolina, disclosed a data breach involving unauthorized access to a server containing patient information. The total number of individuals affected by the data breach has not been publicly disclosed.

An unauthorized party accessed a Dillon Family Medicine server between Oct. 17, 2025, and Oct. 18, 2025. The server contained patient information and was in the process of being decommissioned at the time of the intrusion.

The unauthorized access went undetected for nearly five months, until a suspicious file was discovered on the server during the decommissioning process. A subsequent investigation confirmed on April 14, 2026, that the unauthorized access had occurred during that brief window in October 2025.

McLeod Health stated that the incident was limited to that single server and did not involve any other McLeod Health systems.

On April 25, 2026, a ransomware group known as Qilin claimed responsibility for the attack on the dark web. The group posted on the Tor network that it had obtained the organization's data.

The types of personally identifiable information that may have been exposed include names, dates of birth and Social Security numbers.

Protected health information may also have been involved, including diagnoses, medications, test results, images, health insurance information and treatment information.

McLeod Health began notifying affected patients on June 4, 2026. The organization also posted a notice of the data security incident on its website with information about what occurred and resources available to those who may be affected.

McLeod Health's response to the breach

McLeod Health mailed notification letters to affected Dillon Family Medicine patients, informing them of the incident and providing guidance on steps they can take to protect their information.

The company has also established a dedicated call center for patients with questions or concerns about the breach. The call center can be reached at 888-504-8534 and is available Monday through Friday from 9 a.m. to 9 p.m. Eastern time, except for major U.S. holidays.