CareCloud Confirms 2026 Cyberattack Exposing Data of 3.7 Million Individuals
On March 16, 2026, healthcare technology firm CareCloud disclosed a cyberattack that compromised the personal data of 3.7 million individuals. The breach, initially reported to the U.S. Securities and Exchange Commission (SEC) as a "temporary network disruption," affected one of the company’s six electronic health record (EHR) environments for approximately eight hours.
An investigation later revealed that unidentified attackers accessed one of CareCloud’s AWS environments, exfiltrating files containing individuals’ full names. While the company did not specify the exact nature of the stolen data, it confirmed the total number of affected individuals 3,756,469 in a filing with the U.S. Department of Health and Human Services in late July 2026.
At the time of reporting, no hacking group had claimed responsibility, nor had details about the volume or sensitivity of the stolen data been publicly disclosed.
CareCloud, a publicly traded healthcare IT provider, serves over 40,000 healthcare providers across the U.S., offering cloud-based EHR, practice management, and billing solutions. In its SEC filing, the company stated the incident was "non-material" but acknowledged potential costs related to remediation, legal actions, regulatory compliance, and reputational damage.
The breach underscores the ongoing risks to healthcare data, though the full impact on affected individuals remains unclear.
CareCloud cybersecurity rating report: https://www.rankiteo.com/company/carecloud
"id": "CAR1787235939",
"linkid": "carecloud",
"type": "Breach",
"date": "3/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '3,756,469 individuals',
'industry': 'Healthcare IT',
'location': 'U.S.',
'name': 'CareCloud',
'size': 'Publicly traded, serves over 40,000 '
'healthcare providers',
'type': 'Healthcare Technology Firm'}],
'attack_vector': 'AWS environment compromise',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '3,756,469',
'personally_identifiable_information': 'Full names',
'type_of_data_compromised': 'Full names'},
'date_detected': '2026-03-16',
'date_publicly_disclosed': '2026-03-16',
'description': 'On March 16, 2026, healthcare technology firm CareCloud '
'disclosed a cyberattack that compromised the personal data of '
'3.7 million individuals. The breach affected one of the '
'company’s six electronic health record (EHR) environments for '
'approximately eight hours. Attackers accessed one of '
'CareCloud’s AWS environments, exfiltrating files containing '
'individuals’ full names.',
'impact': {'brand_reputation_impact': 'Potential reputational damage',
'data_compromised': 'Personal data of 3.7 million individuals',
'downtime': '8 hours',
'legal_liabilities': 'Potential legal actions',
'operational_impact': 'Temporary network disruption',
'systems_affected': 'One of six EHR environments'},
'investigation_status': 'Ongoing',
'references': [{'source': 'U.S. Securities and Exchange Commission (SEC)'},
{'source': 'U.S. Department of Health and Human Services'}],
'regulatory_compliance': {'legal_actions': 'Potential legal actions',
'regulatory_notifications': ['SEC',
'U.S. Department of '
'Health and Human '
'Services']},
'response': {'communication_strategy': 'SEC filing, HHS filing'},
'title': 'CareCloud Cyberattack Exposing Data of 3.7 Million Individuals',
'type': 'Data Breach'}