CareCloud Reports Data Breach Affecting 3.75 Million Patients
CareCloud has confirmed that a cyberattack has resulted in the theft of personal information and medical records of more than 3.75 million individuals. This breach, which occurred in March, is now recognized as the fifth-largest theft of health data reported in 2026. The company disclosed the breach in a filing with the Department of Health and Human Services (HHS), revealing that the number of affected individuals was revised upward in a subsequent update. CareCloud, based in New Jersey, provides electronic medical record storage to numerous healthcare providers across the United States, thereby handling vast amounts of patient data and billing information.
The breach involved unauthorized access to patients' medical data stored in one of CareCloud's cloud environments over a six-day period. The hackers reportedly exfiltrated data from the company's Amazon Web Services account, leading to the loss of sensitive information including patients' names, postal addresses, Social Security numbers, and various medical details. Additionally, the stolen data encompassed government-issued identification numbers, such as passports and driver's licenses, along with banking and financial information.
Despite multiple inquiries, CareCloud's chief executive, Stephen Snyder, has not responded regarding the incident, including whether the company has paid a ransom to the hackers or who is responsible for cybersecurity measures at the firm. This breach follows several other significant healthcare data breaches reported this year, including one by TriZetto affecting 3.4 million individuals and another by Craneware, which remains unspecified in terms of the number of affected patients.
According to HHS, the largest data breach reported this year involved DentaQuest, affecting at least 15 million individuals' personal and health information. The ongoing concerns about data security in the healthcare sector continue to highlight the vulnerabilities faced by organizations handling sensitive patient information.
