CareCloud, a prominent provider of electronic health record (EHR) systems, has confirmed that a data breach in March affected 3,756,469 individuals. The company disclosed to federal regulators that an unauthorized actor gained access to one of its Amazon Web Services (AWS) environments, remaining undetected for approximately eight hours.
The breach occurred between March 10 and March 16, during which time the attacker was able to exfiltrate data. The compromised information includes a range of sensitive personal details such as Social Security numbers, identification numbers, credit and debit card information, as well as medical and insurance data.
CareCloud initially reported the incident to law enforcement. By March 24, the company decided to inform the Securities and Exchange Commission (SEC), citing the sensitive nature of the potentially affected information and the possible ramifications of the breach.
Among the nearly 3.8 million individuals impacted, specific numbers have been reported for several states. More than 270,000 affected persons reside in Texas, nearly 58,000 in Oregon, and 23,000 in South Carolina. Figures for residents in New Hampshire, Massachusetts, and California were not specified in the company's notifications.
CareCloud provides technology and software solutions to over 45,000 healthcare providers, offering EHR systems alongside digital revenue and business products. The company reported revenues of $120.5 million in its most recent fiscal year.
No specific hacking group has publicly claimed responsibility for the attack. The incident highlights a continuing trend of cyberattacks targeting large electronic health record companies, with similar breaches affecting other providers serving thousands of hospitals in the past year.
