CareCloud patient-data breach affects 3,756,469 people
A CareCloud cloud breach affected 3,756,469 people, potentially exposing identity, medical and insurance details, plus some card data. Check your notice, use offered identity protection by 17 December, and review financial and insurance statements.
Read your CareCloud notice to see which information was affected, and enrol in any offered IDX protection by 17 December 2026 using your individual code. Consider freezing your US credit files with Equifax, Experian and TransUnion. Review bank, card and health insurance statements, and report unfamiliar transactions or treatment to the relevant provider.
What’s happening
An intruder accessed a CareCloud cloud environment holding patient information between 10 and 16 March 2026 and claimed to have copied database contents. CareCloud reported 3,756,469 affected people to US health authorities. The incident disrupted one of its six electronic health record environments for about eight hours; service returned on 16 March. Although its California sample letter leaves the exposed fields unspecified beyond names, CareCloud's Washington filing identifies possible exposure of addresses, birth dates, Social Security and driving licence numbers, insurance details, physician information, medications and allergies. A very small subset also had complete credit card details, including security codes, affected. Information varied by person. CareCloud says it removed the intruder's access and found no subsequent unauthorised activity. Its notices reported no known resulting identity fraud; later misuse is unknown. Notifications and identity protection followed, but these measures cannot undo any copying of patient data. There is no patient software update to install.
- What
- Breach
- Affects
- CareCloud Health electronic health record services
- Fixed in
- Nothing to patch
- Since
- 10 Mar 2026
- Closed
- 19 Aug 2026
Timeline
- Update
BleepingComputer reported CareCloud's disclosure to US health authorities that 3,756,469 people were affected. The notification offered IDX protection with an enrolment deadline of 17 December 2026.
- Vendor revised
CareCloud's lawyers reported another 54 affected Washington residents and said they had received written notices.
- Update
CareCloud told Washington authorities that written notifications would begin on or about this date. It offered complimentary credit monitoring to residents whose Social Security numbers were affected.
- Update
CareCloud determined which personal information might be affected. Its Washington filing lists identity, insurance and health information, with complete credit card details including security codes affected for a very small subset.
- Made public
CareCloud publicly disclosed the incident in an SEC filing. It had contacted law enforcement and was still determining which patient information had been accessed or copied.
- Update
CareCloud discovered and contained the incident. One of its six electronic health record environments suffered roughly eight hours of disrupted functionality and data access, restored that evening.
- UpdateNothing to patch
Unauthorised access to a CareCloud AWS cloud environment began. CareCloud later established that access continued until 16 March; the intruder claimed to have copied database contents.
Sources
- CareCloud incident notification and supplemental Washington noticeCareCloud · 17 Aug 2026
- CareCloud sample notice of data breachCareCloud · 25 July 2026
- CareCloud Form 8-K: Material Cybersecurity IncidentsCareCloud · 27 Mar 2026
- Healthcare tech firm CareCloud says hackers stole patient dataBleepingComputer · 30 Mar 2026
- Healthtech firm CareCloud data breach impacts 3.7 million patientsBleepingComputer · 19 Aug 2026
- Electronic health record company CareCloud says 3.7 million people affected by breachThe Record · 19 Aug 2026