# CareCloud Breach Exposes Medical and Financial Data of 345,000

Hackers stole social security numbers and banking details from the US health tech company's AWS systems.

- **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb)
- **Published:** 2026-08-02
- **Topic:** [Business](https://brifing.si/c/business)
- **Original article:** <https://securityaffairs.com/196480/cyber-crime/carecloud-breach-exposes-medical-and-financial-data-of-345000.html>
- **On Brifing:** https://brifing.si/s/c8d18fff-347e-4b1c-80a8-b4f4fd1a4599

## Breach Scale

CareCloud disclosed a data breach affecting 345,000 individuals, with medical and financial information compromised in its AWS-hosted systems. The New Jersey-based health tech company serves over 45,000 healthcare providers across the US. Initially reported in March 2026, the number of affected individuals continues to rise as more states file disclosures.

## Compromised Data

Attackers had access to CareCloud's electronic health records for six days between March 10-16, 2026. Stolen data includes patients' names, addresses, social security numbers, passport and driver's license details. Bank account information, payment card numbers, and extensive medical records were also leaked - an ideal combination for identity thieves and health insurance fraudsters.

## Company Profile

CareCloud provides cloud-based electronic health records (EHR), revenue management, and AI-powered software solutions for hospitals and medical centers. With 3,650 employees, the company reported $120.5 million in revenue and $10.8 million GAAP net income for fiscal year 2025. The sensitive data it handles significantly amplifies the breach's impact.

## Industry Breaches

In March, Cognizant's TriZetto Provider Solutions experienced a breach affecting 3.4 million individuals. Last week, billing software provider Craneware confirmed hackers stole substantial data from its hospital and pharmacy clients. These incidents highlight persistent data security vulnerabilities in the healthcare sector.

## Company Response

CareCloud remained mostly silent for four months after the initial disclosure. Details only emerged through mandatory filings with California's Attorney General. The company stated attackers claimed to have exfiltrated data from AWS databases but shared no technical details. No unauthorized activity has been detected since March 16.

## Legal Processes

California's strict data breach notification laws enabled rapid public disclosure. Without state mandates, affected individuals might have waited much longer for notification. CareCloud now faces regulatory filings across multiple states and potential legal consequences.

## Industry Impact

This incident reaffirms how frequently healthcare data falls into the wrong hands, often with delayed patient notification. The CareCloud case demonstrates security risks in cloud-based health systems and how supply chain vulnerabilities can be exploited.

## Conclusions

The CareCloud breach underscores urgent need for improved data security standards in healthcare. Exposure of 345,000 individuals' sensitive information carries significant identity theft and fraud risks. The incident serves as a warning for healthcare organizations using cloud services to reassess their security measures.

## Sources covering this story

- https://securityaffairs.com/196480/cyber-crime/carecloud-breach-exposes-medical-and-financial-data-of-345000.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._