CareCloud Breached: Medical Records and Financial Data of 350,000 Patients Exposed

Six-Day Unauthorized Access in March 2026

CareCloud, a provider of IT solutions for the healthcare sector, has notified a security incident involving its CareCloud Health division. Between March 10 and 16, 2026, an attacker gained access to the Amazon Web Services (AWS) environment used to host electronic health records (EHR). Forensic analysis, completed only on June 24, 2026, confirmed the likely exfiltration of data.

The company has not specified the nature of the access. It is unclear whether a configuration error or compromised credentials were exploited. What is certain is that the malicious activity remained active for almost a week before being blocked.

Stolen Data: A Treasure Trove for Criminals

The breach affects at least 350,000 individuals, as indicated by notifications sent to the attorneys general of several states. The compromised information is extremely detailed: full name, address, date of birth, Social Security numbers (SSN). This is in addition to driver’s license numbers, government-issued IDs, financial account details, and credit or debit card numbers. Furthermore: medical and insurance data.

A set of data that allows for the construction of complete profiles. Identity theft, credit fraud, and unauthorized access to medical care become concrete risks. Victims may find accounts opened in their name or treatments billed for services never received.

CareCloud’s Response: Enhanced Security and Victim Protection

CareCloud stated that it engaged external cybersecurity experts. Priority activities included isolating the compromised environment, removing the threat, and eliminating any unauthorized persistent access. The company also reports having initiated a continuous strengthening of its systems.

To mitigate the impact, CareCloud is offering affected individuals up to 24 months of free identity theft protection. The service includes credit monitoring, restoration assistance, and a $1 million insurance policy. It is a necessary step, but the distrust generated by such breaches will take time to overcome.