CareCloud Data Breach Now Impacts 3.7 Million People

What Happened

CareCloud, a provider of cloud-based solutions for the healthcare industry, has reported that a cyberattack it suffered in March now affects more than 3.7 million individuals. This figure is a dramatic increase from the company's initial disclosure in early July, which stated that approximately 350,000 people were impacted. The true scale of the breach, over ten times larger than first believed, was revealed in an updated filing with the U.S. Department of Health and Human Services (HHS).

The timeline of events began with an intrusion in March. CareCloud announced that it detected the breach between March 10 and March 16. The discovery was made following a disruption involving one of its electronic health record environments. An investigation confirmed that threat actors had gained unauthorized access to one of the company’s Amazon Web Services (AWS) environments. According to the company, the attackers claimed to have exfiltrated information from databases within the compromised environment.

Initial reports filed with various state Attorneys General in July indicated that tens of thousands of individuals were affected in each state, totaling around 350,000. However, figures updated this week on the HHS's data breach tracker portal starkly illustrated the severity of the situation. The number of affected individuals on the portal first appeared as 3,371,508, and was revised a day later to 3,756,469. While this sudden and massive jump initially raised suspicions of a clerical error, HHS officials confirmed to SecurityWeek that the figure is accurate and reflects the most current data provided to the agency by CareCloud.

The Data Compromised

The nature of the data exfiltrated in this breach significantly heightens its potential for devastating impact. The attackers are understood to have accessed highly sensitive information critical for identity theft. The types of compromised data include:

• Personal Identifiers: Full names, home addresses, and dates of birth.
• Official Identification: Social Security Numbers (SSNs) and driver's license numbers. These two pieces of information alone are sufficient for committing identity theft, opening fraudulent bank accounts, or applying for loans.
• Health and Insurance Information: Health insurance policy details, medical records, and information related to healthcare services. This type of data is often more valuable on the dark web than credit card information. It can be used for medical identity theft, such as receiving medical care under another person's name, illegally obtaining prescription drugs, or defrauding insurance companies. Sensitive medical conditions could also be used for blackmail.
• Financial Information: The company stated that for a "very limited subset" of individuals, full payment card information was also stolen. This exposes victims to the risk of direct financial fraud.

How the Attack Occurred

CareCloud has shared limited technical details about the attack. The only confirmed information is that threat actors breached one of the company's AWS cloud environments between March 10 and 16. How they gained this access—whether by exploiting a system vulnerability, using stolen credentials, or taking advantage of a misconfiguration—has not yet been disclosed.

The company noted that the attackers claimed to have exfiltrated data from databases within this environment. It is not known which cybercrime group is behind the attack, and so far, no group has publicly taken credit. Furthermore, it remains unclear whether CareCloud paid a ransom to prevent the data from being released or to retrieve it. Such details are often withheld during ongoing investigations or legal proceedings.

Who Is Affected

Those directly affected by the breach are the patients of healthcare organizations that use CareCloud's services. CareCloud is a technology provider that offers cloud-based software solutions like electronic health records, billing, and practice management to hospitals, clinics, and doctor's offices. Consequently, many patients may have never heard the name CareCloud, yet their personal and medical data was processed through its systems via their healthcare provider. The fact that the breach was reported to Attorneys General in multiple states indicates its geographically widespread impact.

What You Can Do

If you suspect your data was compromised in this breach or have received a notification, you must act immediately to protect your identity and financial security:

• Watch for Official Notifications: CareCloud or your healthcare provider may send you a notification letter. These letters often offer complimentary credit monitoring services. Sign up for them.
• Freeze Your Credit Reports: Contact the three major credit bureaus—Equifax, Experian, and TransUnion—to place a freeze on your credit. This makes it nearly impossible for identity thieves to open new credit accounts in your name and is a more robust protection than a fraud alert.
• Review Your Accounts: Carefully scrutinize your bank accounts, credit card statements, and insurance policies (especially Explanation of Benefits - EOB documents from your health insurer). Report any unrecognized charges or claims for services you did not receive to the respective institution immediately.
• Beware of Phishing Attempts: Cybercriminals may use your stolen personal information to craft highly personalized and legitimate-looking phishing emails or phone calls. Be vigilant against any suspicious communications asking you to confirm information or take urgent action.
• Change Your Passwords: Change the passwords for any relevant patient portals or other online accounts.

What the Company Is Saying

In its public statement in early July, CareCloud acknowledged it had detected a network intrusion in March following a disruption in an electronic health record environment. The company stated that it launched an investigation and was in the process of notifying affected individuals. However, the vast discrepancy between the initially reported number and the final figure submitted to HHS suggests that it took a significant amount of time for the company to determine the full scope of the breach, or that initial assessments were incomplete. The company has not commented on the perpetrators behind the attack or on any potential ransom payment.

Source

https://www.securityweek.com/carecloud-data-breach-impact-grows-to-3-7-million-individuals/