CareCloud confirms theft of medical data on 3.7 million patients

New Jersey-based U.S. company CareCloud has confirmed to federal regulators that a cyberattack resulted in the theft of personal data and medical records belonging to more than 3.75 million people. This is the first official confirmation of the scale of an incident that is now considered the fifth-largest theft of medical data in the U.S. in 2026.

CareCloud stores electronic medical records for tens of thousands of healthcare providers across the country and serves millions of patients, processing vast volumes of data and billing information on behalf of hospitals, doctors' offices and other practices.

What happened

The breach came to light back in March, when the company reported that hackers had access to one of its cloud data stores containing medical data over a six-day period. CareCloud later clarified in its notifications that the attackers had exfiltrated data from its Amazon Web Services account.

The company filed details of the breach with the Department of Health and Human Services (HHS) on Monday, and on Tuesday the number of those affected was reportedly revised upward. The final figure is not yet clear.

The stolen data includes names, mailing addresses, Social Security numbers, and patients' medical information. In addition, the attackers obtained ID document numbers — passports and driver's licenses — along with banking and financial data.

Silence from leadership

Since the March disclosure, CareCloud has not publicly commented on the attack. The company's CEO, Stephen Snyder, did not respond to numerous inquiries — including questions about whether a ransom was paid, who at the company is responsible for cybersecurity, and whether he intends to resign following the incident.

The CareCloud breach continues a string of major healthcare leaks this year. In March, TriZetto confirmed that a 2024 incident had affected 3.4 million people, and in July billing software developer Craneware was hit (the number of victims was not disclosed). The largest breach of the year so far remains the hack of insurer DentaQuest, where, according to HHS, at least 15 million people were affected.

Source: TechCrunch