CareCloud Data Breach Affects Over 3.7 Million Individuals, Exposing Sensitive Health Information

CareCloud, a prominent provider of cloud-based healthcare solutions, recently confirmed a significant data breach that has affected more than 3.7 million individuals. The incident, which was first detected in mid-March 2026 following a disruption in an electronic health record environment, involved unauthorized access to one of the company's Amazon Web Services (AWS) cloud environments. Threat actors gained entry between March 10 and March 16, 2026, and reportedly exfiltrated data from databases within the compromised system. Initially, the breach was thought to impact approximately 350,000 individuals, but updated figures from the Department of Health and Human Services (HHS) breach tracker revealed a much larger scale of compromise, exceeding 3.7 million affected people. The stolen information is highly sensitive, including names, addresses, Social Security Numbers, driver's license numbers, dates of birth, health insurance details, and comprehensive medical and healthcare information. A limited subset of individuals also had their full payment card information exposed. CareCloud has begun distributing data breach notifications to affected individuals, while federal regulators continue to monitor the situation. This breach underscores the persistent and growing cybersecurity threats faced by the healthcare sector, emphasizing the critical need for robust security measures to protect sensitive patient data.