CareCloud breach exposes medical records of more than 3.75 million patients

CareCloud confirmed with federal regulators that hackers stole personal information and medical records belonging to more than 3.75 million people. The company detailed the March data breach in a filing with the Department of Health and Human Services, and the affected count was reportedly revised upward in an update.

The disclosure makes the incident the fifth-largest theft of health data in 2026 so far, according to the TechCrunch report.

The stolen data includes patients’ names, postal addresses, Social Security numbers, medical and health information, government-issued identification numbers such as passports and driver’s licenses, and banking and financial information.

For patients, the key takeaway is that this was not limited to contact details; the exposed categories span identity, health, and financial records.

CareCloud provides electronic medical record storage to tens of thousands of healthcare providers across the United States and handles patient data and billing information for hospitals, doctors’ offices, and other medical practices.

The company previously said hackers accessed patients’ medical data stored in one cloud storage environment over six days, and later said data was exfiltrated from its Amazon Web Services account.

The CareCloud breach follows several sizable healthcare breaches confirmed this year. Tech giant TriZetto confirmed in March that a 2024 breach affected 3.4 million people’s data, while TechCrunch also reported an unspecified number of people had data stolen during a July breach at health tech billing software maker Craneware.

According to HHS’ running tally cited in the report, DentaQuest has had the largest healthcare data breach this year so far, affecting at least 15 million people’s personal and health information.