Goshen Medical Center Data Breach — Case File

From the AG filing description

Goshen Medical Center operates as a critical healthcare provider within South Carolina, delivering comprehensive medical services, patient care, diagnostic testing, and specialized treatments to local communities. Because of its core mission in the healthcare sector, the organization routinely collects, processes, and stores vast amounts of highly sensitive personal and medical data. This repository includes not only basic administrative records but also intimate details regarding patient health histories, insurance coverage, and personal identification numbers, all of which are essential for coordinating patient care and processing medical billing. In 2025, Goshen Medical Center reported a major security incident to the South Carolina Attorney General, signaling a critical breakdown in its digital defenses. In the healthcare industry, breaches of this magnitude typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized intrusions into electronic health record databases, or vulnerabilities exploited within third-party medical billing and vendor networks. These incidents often expose the inadequacies of legacy IT infrastructure and highlight potential gaps in network monitoring, allowing unauthorized actors to dwell within sensitive systems before exfiltrating confidential files. The exposure resulting from the Goshen Medical Center incident threatens individuals with severe, multi-faceted risks. Compromised information frequently includes full names, dates of birth, Social Security numbers, medical record numbers, health insurance details, and detailed diagnosis and treatment histories. When medical data falls into the wrong hands, victims face immediate dangers of medical identity theft—where unauthorized parties obtain care under a victim's name—as well as fraudulent insurance claims, compromised financial accounts, and targeted phishing scams designed to exploit vulnerable patients using their specific healthcare details. As a covered entity handling protected health information, Goshen Medical Center was bound by strict regulatory standards, most notably the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. These federal laws mandate robust administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of patient data. The occurrence of a significant data breach strongly suggests a potential failure in meeting these legal obligations, raising serious questions about whether the institution maintained adequate encryption, access controls, and cybersecurity protocols. Receiving a data breach notification letter from Goshen Medical Center is a formal acknowledgement that your private health and personal information was compromised due to the organization's security failures. Legally, this notification establishes the standing necessary to participate in a class action lawsuit aimed at holding the facility accountable for failing to protect your data. You do not need to wait until financial or medical fraud occurs to seek justice, and our firm handles these cases on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.