Healthtech firm CareCloud reveals March 2026 data breach impacted 3.7 million patients
Impacted CareCloud patients are being notified, but we don't know what information was taken.
In March 2026, the healthtech firm CareCloud disclosed a cyberattack that compromised the data of 3.7 million patients. The attackers breached one of CareCloud's AWS environments, stealing personal records, predominantly names. The incident, while deemed non-material, could lead to significant expenses in remediation and response, legal fees, regulatory compliance, and potential reputational damage.
CareCloud initially reported the disruption to its Health division, which impacted one of six electronic health record environments for about eight hours. The company acknowledged that criminals accessed patients' personal information but did not specify the exact number of affected individuals, the nature of the files, or whether they were exfiltrated.
Following a late July 2026 notification to customers, CareCloud revealed that the hackers accessed one of its AWS environments and claimed to have stolen files, though the type of data taken remained undisclosed.
The company's disclosure to the US Department of Health and Human Services confirmed that 3,756,469 individuals were affected. Despite no hacking group claiming responsibility or sharing details about the stolen data's volume, nature, and type, CareCloud remains a major player in the healthcare technology sector, offering cloud-based software and services to healthcare providers across the United States.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
