CareCloud Reports Data Breach Affecting Medical Records of 3.7 Million People

A security breach at CareCloud, a provider specializing in healthcare data services, has led to the exposure of personal and medical information belonging to more than 3.75 million individuals. This incident has been reported to federal agencies and is now recognized as the fifth-largest health data theft case in 2026, underscoring its severity.

In a report sent to the Department of Health and Human Services (HHS) on Monday, CareCloud detailed the breach that took place in March. An update shared on Tuesday indicated a revision in the count of affected individuals, although it remains uncertain if this figure will continue to grow.

Located in New Jersey, CareCloud provides electronic medical record storage solutions to a variety of healthcare providers throughout the United States, affecting millions of patients. The company is crucial in handling substantial amounts of patient information and billing data for hospitals, physician practices, and other healthcare organizations.

Since disclosing the breach in March, CareCloud has restricted public commentary regarding the cyber incident. Early reports suggested that hackers accessed patient medical data stored in one of its cloud systems for a period of six days. Further updates indicated that the attackers retrieved data from the company’s Amazon Web Services account, resulting in major patient data loss.

The compromised information includes patients’ names, home addresses, Social Security numbers, and various medical and health-related records. Additionally, the hackers acquired government-issued identification numbers, such as those from passports and driver’s licenses, along with financial and banking details.

Stephen Snyder, the CEO of CareCloud, has not responded to numerous inquiries regarding the breach, including questions about whether the company has made any payments to the hackers, who is in charge of overseeing cybersecurity at CareCloud, or if he intends to resign in light of the incident.

This event at CareCloud occurs alongside several other significant healthcare data breaches reported this year.

In March 2024, tech giant TriZetto disclosed a data breach affecting 3.4 million individuals, while a July incident involving healthtech billing software provider Craneware compromised data for an undisclosed number of individuals.

According to HHS’s ongoing record of healthcare data breaches, DentaQuest, a prominent dental insurance provider, has suffered the largest breach this year, impacting at least 15 million individuals’ personal and health information.