CareCloud Notifies Hundreds of Thousands After Medical Records Breach

CareCloud has begun notifying nearly 350,000 individuals that their medical records were stolen during a cyberattack earlier this year. The New Jersey-based health tech company, which manages patient records for over 45,000 healthcare providers across the United States, confirmed the breach in a notice filed with California's attorney general. The attack occurred between March 10 and March 16, during which hackers accessed one of CareCloud's electronic health record data stores.

The company has remained largely silent about the breach since its initial disclosure in March, but new details reveal that the hackers claimed to have exfiltrated data from the databases. While CareCloud did not specify how the hackers made this claim, it is common for cybercriminals to provide samples of stolen data to victims alongside ransom demands. As of now, no ransomware group has publicly taken responsibility for the breach.

The data breach affects individuals across multiple states, including New Hampshire, Massachusetts, and Texas. The notifications confirm that the stolen information includes names, postal addresses, Social Security numbers, government-issued identification numbers, financial details such as bank account information and payment card numbers, as well as extensive medical and health-related data.

The number of affected individuals may increase as more disclosures are made to state authorities. CareCloud's chief executive, Stephen Snyder, did not respond to requests for comment regarding the incident. This breach is part of a broader pattern of cyberattacks targeting healthcare providers in 2023, which includes significant breaches at other organizations such as TriZetto and NYC Health + Hospitals.

The ongoing threat to healthcare data underscores the need for robust cybersecurity measures within the industry, as breaches can have serious implications for patient privacy and safety.