CareCloud notifies 345k patients after healthcare data breach
US health tech giant CareCloud begins alerting hundreds of thousands after hackers stole medical records in March attack.
1Scale of the attack
US healthcare technology company CareCloud disclosed that medical records of over 345,000 individuals were stolen in a March cyberattack. The New Jersey-based firm serves more than 45,000 healthcare providers nationwide. Hackers had access to electronic health records hosted on Amazon Web Services for six days, according to the investigation.
2Compromised data details
Stolen data includes patients' names, addresses, and Social Security numbers. Official identification documents like passports and driver's licenses were also compromised, along with bank account and payment card information. CareCloud confirmed to California authorities that hackers exfiltrated database contents but didn't disclose whether ransom was demanded.
3Notification process
CareCloud initially reported the March breach to regulators on March 27. The company is now mailing notifications to hundreds of thousands of affected individuals. Filings with state attorneys general in New Hampshire, Massachusetts, and Texas reveal the breach's scope. TechCrunch also obtained documents submitted to Maine's attorney general.
4Other healthcare breaches
The CareCloud attack isn't an isolated incident. This year, TriZetto suffered a breach affecting 3.4 million people. NYC Health + Hospitals in New York had 1.8 million health records and thousands of employee fingerprint scans stolen. UK-based Craneware also confirmed theft of 'significant volume' of customer data from its servers.
5Company response
CareCloud CEO Stephen Snyder didn't respond to TechCrunch's requests for comment. The company has provided minimal details about the breach since March. While hackers claimed to have exfiltrated data, CareCloud didn't explain how this claim was made. Cybersecurity experts note that hackers often share stolen data samples with ransom demands.
6Data security concerns
The attack highlights growing concerns about healthcare data security. Major health tech providers like CareCloud handle sensitive information for millions of patients. Data stored on cloud platforms like AWS presents attractive targets for cybercriminals. Security professionals are calling for enhanced protection measures across the industry.
7Regulatory implications
CareCloud is required to report the breach to state attorneys general. California filings show data was accessed between March 10-16. The number of affected individuals is expected to rise as more state notifications are filed. Questions remain about whether the company violated data protection regulations.
8Industry impact
The CareCloud breach underscores persistent cybersecurity vulnerabilities in health tech. Companies handling patients' most sensitive data must reassess their security protocols. A series of large-scale breaches is increasing pressure for stricter industry regulations and oversight measures to protect patient information.
Original article: cybersecurity | TechCrunch — CareCloud'da 345 bin kişinin sağlık verileri çalındı