CareCloud Confirms Data Breach Affecting Over 345,000 Medical Records

CareCloud, a prominent New Jersey-based health technology company, has officially acknowledged a significant data breach that compromises the sensitive information of hundreds of thousands of patients. While the company first disclosed the occurrence of a cyberattack in March, recent filings with state attorneys general have clarified the scale of the incident. It is now confirmed that at least 345,000 individuals across the United States have had their data exposed. The breach originated from one of the company’s six internal patient data repositories. Given that CareCloud serves more than 45,000 healthcare providers, including hospitals and medical offices, the potential for further impacted individuals remains high as state-level disclosures continue to be processed. The company had initially maintained a quiet posture regarding the specifics of the intrusion, but new regulatory filings have provided the most detailed assessment of the incident to date.

According to official breach notices provided to regulatory authorities, unauthorized actors maintained access to a specific electronic health record data store for a period of six days. The breach window lasted from March 10, 2026, to March 16, 2026. Investigators confirmed that the compromised infrastructure was hosted on Amazon Web Services (AWS). Although the company has not publicly detailed the exact mechanism of the unauthorized entry, they acknowledged that the perpetrators claimed to have successfully exfiltrated data from their databases. Such claims are frequently associated with digital extortion attempts, where attackers provide samples of stolen information to victims as proof of a successful breach, often as a prelude to ransom demands meant to prevent the public disclosure of the stolen files. Despite these indicators, CareCloud has not confirmed the involvement of a specific ransomware or extortion syndicate, and no known group has publicly taken responsibility for the attack at this time.

The breadth of the stolen information places affected individuals at a high risk for identity theft and financial fraud. Regulatory filings indicate that the exfiltrated records contained a comprehensive range of personal identifiers. Beyond standard contact details such as names and postal addresses, the hackers accessed highly sensitive information, including Social Security numbers and government-issued identification, such as passports and driver’s licenses. Furthermore, the breach compromised financial security, as bank account details and payment card numbers were among the files accessed by the intruders. Perhaps most concerning for patients is the exposure of medical and health-related records, which contain information that could be leveraged for medical identity theft. The company is currently in the process of notifying these individuals, though the lack of public comment from CareCloud CEO Stephen Snyder has left many questions regarding the firm's long-term remediation strategies unanswered.

The CareCloud incident is part of a troubling, persistent trend of cyberattacks targeting the healthcare technology sector in 2026. This industry has become a primary target for malicious actors due to the high value of personal health information on the black market. The scale of the CareCloud breach mirrors other recent major security failures in the field. For instance, the healthcare revenue firm TriZetto recently experienced a breach that impacted 3.4 million people. Similarly, NYC Health + Hospitals dealt with a month-long intrusion that resulted in the theft of health data belonging to 1.8 million patients, as well as the loss of employee fingerprint records. These events, combined with a separate, significant data theft confirmed last week by U.K.-based tech provider Craneware, highlight a systemic vulnerability in the digital accounting and billing infrastructure supporting U.S. medical providers, placing patient privacy at the forefront of cybersecurity concerns.