CareCloud breach exposes 3.75 million health records

Healthcare infrastructure provider CareCloud has confirmed a data breach affecting 3.75 million patients, ranking among the largest health data incidents reported in the U.S. this year. The breach exposed sensitive information stored in the company’s Amazon Web Services environment, where attackers operated undetected for six days before the intrusion was discovered.

What happened

CareCloud, which supplies electronic medical record storage to thousands of healthcare providers, first disclosed the incident in March. The company later revealed that hackers accessed patient data directly from its AWS account over a six-day period. The stolen records include Social Security numbers, medical histories, government-issued IDs, and banking details—information sufficient for identity theft or insurance fraud at scale.

The final tally of 3.75 million affected individuals was reported in a filing with the Department of Health and Human Services on Monday. The company revised the figure upward the following day, though it remains unclear whether further adjustments will follow. CareCloud has not disclosed whether a ransom was paid, who oversees its cybersecurity operations, or whether leadership changes are under consideration. CEO Stephen Snyder has not responded to repeated requests for comment.

Why it matters

CareCloud’s role as a backend provider amplifies the breach’s impact. Unlike a single hospital or clinic, its systems aggregate patient data from tens of thousands of healthcare providers. A single compromised environment can thus expose records from countless independent practices and facilities simultaneously. The incident underscores the risks of centralized health data storage, particularly when hosted on third-party cloud platforms.

The breach also highlights persistent detection gaps in cloud security. Attackers remained inside CareCloud’s AWS environment for nearly a week before being noticed—a delay that allowed them to exfiltrate millions of records. The stolen data’s breadth, from financial details to medical histories, creates long-term risks for affected patients, including fraud and targeted phishing campaigns.

Broader context

nThis incident is the fifth-largest health data breach reported in the U.S. in 2026. Other major incidents this year include a 3.4 million-record breach at TriZetto (confirmed in March) and an ongoing investigation into a July breach at billing software provider Craneware. DentaQuest currently holds the record for the largest breach of the year, with at least 15 million individuals affected.

CareCloud’s silence on security practices and leadership accountability leaves critical questions unanswered. Without transparency about detection methods, response protocols, or potential lapses, healthcare providers and patients are left to assess their exposure without full information. The breach also raises regulatory concerns, as HHS investigations may scrutinize whether CareCloud’s security measures met industry standards for protecting sensitive health data.