CareCloud Data Breach Affects Over 350,000 People

What Happened

Healthcare information technology company CareCloud has publicly disclosed a large-scale data breach affecting at least 350,000 people. According to the company's statement, the incident targeted an electronic health record (EHR) environment within its CareCloud Health division. The breach was first indicated by a service disruption on March 16, 2026. A comprehensive investigation launched thereafter revealed the full scope and severity of the event.

The investigation determined that cyberattackers gained unauthorized access to one of the company's Amazon Web Services (AWS) cloud environments between March 10 and March 16, 2026. During this six-day window, the attackers are believed to have exfiltrated sensitive data from the system. The company also clarified the timeline of discovery; the investigation concluded on June 24, 2026, confirming the nature of the stolen data, which initiated the process of notifying affected individuals. A copy of the notification letter filed with the Massachusetts Office of Consumer Affairs and Business Regulation laid out the details of the breach.

What Data Was Stolen

According to the official statement from CareCloud, the data compromised by the cyberattackers is extensive and highly sensitive. This poses significant risks of identity theft, fraud, and privacy violations for the victims. The stolen information includes:

• Personal Identifiable Information (PII): Full names, home addresses, and dates of birth.
• Official Identification: Social Security numbers (SSNs), driver's license numbers, and other government-issued ID numbers.
• Financial Information: Financial account numbers, and credit/debit card numbers.
• Protected Health Information (PHI): Medical records, diagnoses, treatments, and health insurance information.

The combination of this stolen data dramatically increases the risk. For example, a person's name, address, Social Security number, and financial details are sufficient for identity thieves to apply for new credit cards, drain bank accounts, or take out loans in the victim's name. The exfiltration of medical information can lead to more complex threats. This data can be used in highly targeted phishing attacks, facilitate insurance fraud, or, in a worst-case scenario, be used as leverage for blackmail. The compromise of non-changeable information like Social Security numbers represents a lifelong risk for the victims.

How the Attack Happened

According to the company's disclosure, the attackers managed to infiltrate an environment within CareCloud's AWS infrastructure between March 10 and March 16, 2026. It is presumed that data was exfiltrated during this period. However, technical details regarding how the attackers gained this access have not yet been shared. It remains unclear whether they exploited a specific vulnerability, used a phishing attack, or obtained credentials through other means.

CareCloud stated that it engaged external cybersecurity experts following the incident and, with their assistance, secured the affected environment. The investigation confirmed that the threat was eliminated and no persistent unauthorized access remained. The company also added that it is continuing to strengthen the security of its systems and environments to prevent similar incidents in the future. No information has been released about the identity of the threat actor or group behind the attack.

Who Is Affected

The data breach affects individuals whose information was stored in CareCloud's electronic health record systems. Based on official filings with the Attorney General's Offices in several states, the number of confirmed victims is at least 350,000. However, it is not clear if this is the final total. CareCloud has not yet disclosed the total number of impacted individuals, so it is possible that this number could rise as more information becomes available.

What You Can Do

If you have received services from a healthcare provider that uses CareCloud and believe you may be affected by this breach, there are several important steps you can take:

• Review the Official Notification Carefully: CareCloud is sending notification letters to affected individuals by mail. This letter will contain specific information about your case and instructions on how to take advantage of the services offered.
• Activate the Identity Theft Protection Service: The company is offering victims up to 24 months of free identity theft protection, credit monitoring, and ID theft recovery services. These services alert you if suspicious activity is detected in your name. A $1,000,000 insurance reimbursement policy is also included. Activate this service as soon as possible.
• Consider a Credit Freeze: You may want to contact the three major credit bureaus (Equifax, Experian, TransUnion) to place a freeze on your credit reports. This action significantly hinders identity thieves from opening new accounts or taking out loans in your name.
• Monitor Your Accounts: Regularly check your bank, credit card, and insurance statements for any transactions you do not recognize. Report any suspicious activity to the respective institution immediately.
• Be Vigilant Against Phishing Attempts: Cybercriminals may use the stolen personal information to craft highly convincing and personalized phishing emails or messages. Do not trust any communication that asks for personal information or contains suspicious links.

What the Company Says

In its statement, CareCloud emphasized that it is aware of the seriousness of the incident and has taken necessary steps. "CareCloud engaged external cybersecurity experts and, with their assistance, secured the affected environment, eliminated the threat, and confirmed that no persistent unauthorized access remained. CareCloud is continuing to strengthen the security of its systems and environments," the company stated. It also noted its goal to minimize harm by offering 24 months of identity protection services to victims. However, despite inquiries from SecurityWeek, the company has not yet responded with additional details on the total number of affected individuals or the threat actor responsible for the attack.

Source

https://www.securityweek.com/carecloud-data-breach-impacts-over-350000/