In mid-March 2026, threat actors gained unauthorized access to one of CareCloud's AWS environments, compromising sensitive data of over 3.7 million individuals. The stolen data includes personally identifiable information (PII) such as names, addresses, Social Security numbers, driver’s license numbers, dates of birth, health insurance information, and medical and healthcare records. For a very limited subset, full payment card information was also exfiltrated. The breach was detected after a disruption in the electronic health record environment. The initial public reports underestimated the scale, with state Attorney General disclosures citing roughly 350,000 affected individuals, while the HHS breach tracker later confirmed the much larger impact. No known cybercrime group has publicly taken credit, and details about ransom payments remain undisclosed.

The breach exposed highly sensitive personal and healthcare information of over 3.7 million individuals, increasing the risk of identity theft, financial fraud, and privacy violations. The inclusion of Social Security numbers, driver’s license numbers, and medical records significantly raises the severity of potential harm to affected individuals. The compromise of payment card information for a subset of individuals adds a financial risk dimension. The large scale of the breach also poses reputational and regulatory risks for CareCloud.

No specific remediation or patch is applicable as this is a data breach incident rather than a software vulnerability. Organizations and individuals affected should follow guidance from CareCloud and relevant authorities regarding monitoring for identity theft and fraud. CareCloud should continue cooperating with regulatory bodies and enhance security controls to prevent future unauthorized access. The vendor advisory status is not applicable; patch status is not relevant for this breach.