CareCloud, a U.S. healthcare IT company, has confirmed that a data breach earlier this year impacted over 3.7 million individuals. The publicly traded firm, which provides electronic health records, medical billing, practice management, and revenue-cycle services, initially disclosed the incident in March through a filing with the U.S. Securities and Exchange Commission (SEC).
The SEC filing noted that the attack resulted in an eight-hour network disruption on CareCloud's platform and restricted access to one of its databases. At that time, the company indicated that the compromised environment contained patient data, raising concerns about the potential theft of sensitive medical information.
Following an investigation into the scope of the breach, CareCloud reported to the U.S. Department of Health and Human Services that 3,756,469 individuals were affected. The company began distributing data breach notifications on July 25, providing further details uncovered during its inquiry.
According to the notifications, an unauthorized third party accessed one of CareCloud's Amazon Web Services (AWS) environments between March 10 and March 16, 2026. The attacker claimed to have exfiltrated data from databases within that environment.
While the notification confirmed that full names were exposed, a sample letter shared with authorities did not specify other types of data that may have been compromised. CareCloud is offering affected individuals 12 to 24 months of identity protection service coverage through IDX, which can be redeemed until December 17, 2026.
Given that CareCloud does not have a direct relationship with patients, many impacted individuals may be encountering the company's name for the first time. Cybersecurity experts recommend that those affected take appropriate measures to mitigate risks from the incident and remain vigilant against potential phishing attempts leveraging the stolen data.
As of the latest reports, no ransomware groups or data extortion gangs have publicly claimed responsibility for the attack on CareCloud.
