Contained High impact Data breach Checked 1d ago

CareCloud breach exposes data of 345,000 patients

CareCloud says an intruder accessed one cloud account tied to one of its six electronic health record systems and stole patient information over six days in March. The March 16 incident disrupted access for about eight hours. On August 17, CareCloud told federal regulators the breach actually affected more than 3.75 million patients, a sharp jump from the roughly 345,000 first reported over the summer, with the total revised upward again the next day. As of September 7, coverage of the breach remains settled on that confirmed total, with only recap articles and no new developments found.

Started
Mar 1, 2026
Latest activity
Sep 1, 2026
Attributed to
Not confirmedNo credible attribution yet
Where
United States
Sectors
Healthcare
Scale
more than 3.75 million patients (3,756,469 individuals per CareCloud's HHS filing) confirmed as of August 18-19, 2026, the fifth largest

Current status

No new credible reporting or official statement was found after the September 1, 2026 recap.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Impact

Hackers stole medical, financial, and identity data from one CareCloud cloud account and disrupted access to one of its six electronic health record systems for about eight hours in March. CareCloud says access was fully restored that day and found no unauthorized activity after March 16. The stolen data includes patient names, addresses, Social Security numbers, medical and health information, government ID numbers such as passports and driver's licenses, and banking and financial information. CareCloud's CEO has declined to answer questions about whether a ransom was paid or who is responsible for the company's cybersecurity. CareCloud told the SEC the incident is not expected to be financially material but could bring remediation, legal, and notification costs. No ransom payment or attacker group has been named publicly.

What to do

If you get a breach notice from CareCloud, watch your medical, financial, and credit accounts for fraud and consider the free credit monitoring the company is offering. If you already filed or are considering a class action claim, that is a separate legal process and does not change what steps to take to protect your accounts.

Timeline

  1. Sep 1, 2026

    A recap article restated the confirmed 3.75 million patient total from CareCloud's HHS filing and framed the incident as part of a broader pattern of large healthcare cloud breaches, with no new count, attribution, or closure details.

    Containedyahoo.com
  2. Aug 21, 2026

    Follow-up coverage from HIPAA Journal, Security Boulevard, and MD+DI restated the confirmed 3.75 million patient total from the August 17-18 HHS filing, with no new victim count, attribution, or closure news.

    Containedhipaajournal.com
  3. Aug 18, 2026

    The number of affected patients in CareCloud's HHS filing was revised upward to more than 3.75 million, making it the fifth largest US health data breach reported so far in 2026.

    Containedtechcrunch.com
  4. Aug 17, 2026

    CareCloud filed details of the March breach with the US Department of Health and Human Services, the first official confirmation of the incident's true scale.

    Containedtechcrunch.com
  5. Aug 13, 2026

    On its Q2 2026 earnings call, CareCloud executives said patient notifications from the March breach are still underway, forensic analysis is complete, and the company expects cyber insurance to cover most related costs.

    Containedfinance.yahoo.com
  6. Aug 6, 2026

    CareCloud said all affected systems were operational, investigators found no unauthorized activity after March 16, and patient notifications and legal cases were continuing.

    Containedsec.gov
  7. Jul 31, 2026

    Reported victim total passed 350,000 as additional state disclosures were filed.

    Containedsecurityweek.com
  8. Jul 17, 2026

    CareCloud began notifying nearly 345,000 people affected as more state breach filings came in.

    Containedsecurityaffairs.com
  9. Mar 1, 2026

    CareCloud first disclosed a security incident involving unauthorized access to its AWS environment supporting CareCloud Health.

    Containedgbhackers.com

Sources

Related reports