CareCloud breach: medical data of nearly 350,000 patients stolen

CareCloud, an American company and one of the largest handlers of medical data in the US, has started sending notifications to patients whose records were stolen in a cyberattack. According to TechCrunch, at least 345,000 people have been affected so far, and that number is likely to grow as new filings reach individual state authorities.

Based in New Jersey, CareCloud holds records for more than 45,000 healthcare providers across the country — doctors' offices, hospitals and clinics. Sensitive medical and payment information for millions of patients flows through its systems.

What is known about the breach

According to a notice filed this week with the office of the California attorney general, the intruders had access to one of the company's electronic health record stores for at least six days — from March 10 to March 16. The company said that a hacker “claimed to have exfiltrated data from its databases.” It is not specified how this claim was made, but statements like these usually accompany a ransom demand: the attackers send samples of the stolen data and threaten to publish it.

So far no ransomware group has publicly claimed responsibility for the attack. The notifications confirm earlier reporting by TechCrunch that the breach affected data hosted in the Amazon Web Services cloud.

The makeup of the stolen information is worrying: names, mailing addresses, Social Security numbers, government document details (passports and driver's licenses), as well as financial data — bank account information and payment card numbers. On top of that, a large amount of medical information was leaked.

CareCloud's chief executive, Stephen Snyder, did not respond to the publication's request for comment. The company itself has kept silent about the incident since March, when it first acknowledged that hackers had breached one of its six data stores.

Part of a broader wave

The attack on CareCloud fits into a string of breaches in the US healthcare sector this year. Earlier victims included the medical fintech provider TriZetto (3.4 million people), as well as the New York public clinic network NYC Health + Hospitals, where a month-long attack led to the theft of 1.8 million patients' data and the fingerprints of thousands of employees. Last week the British firm Craneware, which supplies accounting and billing software to thousands of American healthcare providers, reported the theft of a “significant amount” of customer data.

Source: TechCrunch