CareCloud Breach Exposes Medical and Financial Data of 345,000
Hackers stole social security numbers and banking details from the US health tech company's AWS systems.
1Breach Scale
CareCloud disclosed a data breach affecting 345,000 individuals, with medical and financial information compromised in its AWS-hosted systems. The New Jersey-based health tech company serves over 45,000 healthcare providers across the US. Initially reported in March 2026, the number of affected individuals continues to rise as more states file disclosures.
2Compromised Data
Attackers had access to CareCloud's electronic health records for six days between March 10-16, 2026. Stolen data includes patients' names, addresses, social security numbers, passport and driver's license details. Bank account information, payment card numbers, and extensive medical records were also leaked - an ideal combination for identity thieves and health insurance fraudsters.
3Company Profile
CareCloud provides cloud-based electronic health records (EHR), revenue management, and AI-powered software solutions for hospitals and medical centers. With 3,650 employees, the company reported $120.5 million in revenue and $10.8 million GAAP net income for fiscal year 2025. The sensitive data it handles significantly amplifies the breach's impact.
4Industry Breaches
In March, Cognizant's TriZetto Provider Solutions experienced a breach affecting 3.4 million individuals. Last week, billing software provider Craneware confirmed hackers stole substantial data from its hospital and pharmacy clients. These incidents highlight persistent data security vulnerabilities in the healthcare sector.
5Company Response
CareCloud remained mostly silent for four months after the initial disclosure. Details only emerged through mandatory filings with California's Attorney General. The company stated attackers claimed to have exfiltrated data from AWS databases but shared no technical details. No unauthorized activity has been detected since March 16.
6Legal Processes
California's strict data breach notification laws enabled rapid public disclosure. Without state mandates, affected individuals might have waited much longer for notification. CareCloud now faces regulatory filings across multiple states and potential legal consequences.
7Industry Impact
This incident reaffirms how frequently healthcare data falls into the wrong hands, often with delayed patient notification. The CareCloud case demonstrates security risks in cloud-based health systems and how supply chain vulnerabilities can be exploited.
8Conclusions
The CareCloud breach underscores urgent need for improved data security standards in healthcare. Exposure of 345,000 individuals' sensitive information carries significant identity theft and fraud risks. The incident serves as a warning for healthcare organizations using cloud services to reassess their security measures.