CareCloud confirms massive data breach after 3.7M patients’ records stolen – What we know
&imwidth=600&imheight=450&format=webp&quality=medium "CareCloud confirms massive data breach after 3.7M patients’ records stolen – What we know")
Representative image. Photograph: (Magnific)
CareCloud has confirmed that hackers stole medical and personal data of more than 3.7 million patients in a March breach, making it the fifth-largest US healthcare data theft of 2026.
Personal information and medical records of more than 3.75 million people was stolen in a massive cyberattack on healthcare technology company CareCloud, making the breach the fifth-largest healthcare data theft reported in the US so far this year. CareCloud disclosed the number of affected individuals in a filing with the US Department of Health and Human Services (HHS) on Monday (Aug 17). The figure was revised upward in an update a day later, raising the possibility that the final toll could increase further.
The New Jersey-based company provides electronic medical record and billing services to tens of thousands of healthcare providers across the United States. Its systems store sensitive information belonging to millions of patients, including data handled on behalf of hospitals, clinics and doctors’ offices.
What information was stolen?
The breach dates back to March, when hackers accessed patient information stored in one of CareCloud’s cloud environments for six days. The company later said the attackers had removed data from its Amazon Web Services account.
The stolen information includes names, postal addresses, Social Security numbers and medical records. Hackers also obtained government-issued identification details, including passport and driver’s licence numbers, as well as banking and other financial information.
Also read | ChatGPT for Teens? OpenAI rolls out new version with safety features – All you need to know
Trending Stories
&im=FitAndFill=(700,400))
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
The combination of medical, identity and financial records could leave affected individuals vulnerable to identity theft and financial fraud.
CareCloud has offered limited public information about the incident since first disclosing the breach in March. It is unclear whether the company paid a ransom or who was responsible for cybersecurity at the company.
Healthcare sector faces growing cyber threat
The CareCloud breach is the latest in a string of major attacks affecting the US healthcare industry.
TriZetto said in March that a 2024 breach had compromised information belonging to 3.4 million people. Health technology billing software company Craneware also reported a July breach, although the number of affected individuals has not yet been disclosed.
HHS data shows dental insurance company DentaQuest has reported the largest healthcare breach of 2026 so far, affecting at least 15 million people.
The latest incident highlights the growing risks for healthcare companies that store huge volumes of sensitive patient information in cloud-based systems.
