CareCloud cyberattack exposed data of 3.7 million patients

Full text

CareCloud confirmed March 16 2026 cyberattack exposed data of 3.7 million individuals

Attackers accessed one AWS environment, stealing personal records including names

Incident deemed non‑material but may incur remediation, legal, and reputational costs

The March 2026 cyberattack on CareCloud exposed sensitive data on 3.7 million people, the company has confirmed.

The American IT healthcare company had told the US Securities and Exchange Commission (SEC) it experienced a “temporary network disruption” in its Health division which “partially impacted the functionality and data access to one of six electronic health record environments for approximately eight hours."

Initial investigation determined that the criminals accessed people’s personal records, but it was not said how many people were affected, what the nature of the files were, or if they were exfiltrated or just exposed.

Notifying the Department of Health

In late July 2026, the company started notifying its customers of the incident, saying the unidentified actors accessed one of CareCloud’s AWS environments and claimed to have stolen files found there. The company did not say which type of data was taken, other than people’s full names.

In a separate report with the US Department of Health and Human Services, the company confirmed the exact number of affected individuals as 3,756,469.

At press time, no hacking groups claimed responsibility for the attack, or shared details about the volume, nature, and type of data potentially stolen.

CareCloud is a publicly traded American healthcare technology firm providing cloud‑based software and services to medical practices and health systems, including electronic health records (EHR), practice management, billing and revenue cycle solutions. It works with tens of thousands of healthcare providers across the United States in more than 70 specialties and across all 50 states, with over 40,000 providers on its platform.

In its initial report with the SEC, CareCloud said the incident did not have a material impact, but that it might incur expenses in remediation and response costs, legal, regulatory and notification-related matters, and could possibly affect patients, customers, counterparties, reputation and operations.

Via BleepingComputer