CareCloud, a healthcare technology provider, has confirmed a data breach that exposed the personal and medical information of over 3.75 million individuals. The incident, which occurred in March, involved an unauthorized third party accessing one of the company's Amazon Web Services (AWS) environments.
The New Jersey-based company, which specializes in electronic health record (EHR) and practice management services, initially disclosed an intrusion in an SEC filing in March. At that time, the estimated number of affected individuals was approximately 345,000. However, the scope of the breach significantly expanded this month, with the Department of Health and Human Services (HHS) breach tracker updating the total to 3,756,469 individuals.
CareCloud stated that the unauthorized access to its AWS environment took place between March 10 and March 16, 2026. The intrusion led to an eight-hour disruption in one of the company's six EHR environments before systems were restored on the same evening.
During a subsequent forensic investigation, CareCloud determined that the attacker claimed to have exfiltrated data from databases within the compromised environment. The stolen information reportedly includes a range of sensitive personal and medical details.
Confirmed categories of exposed data include full names, postal addresses, and dates of birth. The breach also involved Social Security numbers (SSNs) and driver's license or passport numbers. Medical records and health insurance information were also compromised. For a limited subset of victims, bank account and financial details, including full credit card data with CVV, were also exposed.
