U.S. healthcare IT company CareCloud disclosed that the data breach incident it suffered earlier this year has impacted more than 3.7 million individuals.
The healthcare technology organization is publicly traded and provides electronic health records, medical billing, practice management, and revenue-cycle services.
The company disclosed the incident in March via a filing with the U.S. Securities and Exchange Commission (SEC), noting that the attack caused an 8-hour network disruption on its platform and cut access to one of its databases.
At the time, the firm said the compromised environment contained patient data, indicating the risk of sensitive medical information being stolen.
Following the incident, CareCloud launched an investigation to determine its scope and how many people were potentially impacted.
In a report to the U.S. Department of Health and Human Services, the company informs that the number of people affected by the breach was 3,756,469.
CareCloud started to distribute data breach notifications on July 25, sharing more details uncovered during the investigation.
“The investigation determined that, between March 10 and March 16, 2026, an unauthorized third party accessed one of CareCloud’s AWS environments and claimed to have exfiltrated data from databases within that environment,” the notification says.
Beyond full names, the sample letter shared with authorities does not specify the type of data exposed.
The notification recipients are offered 12/24 months of identity protection service coverage through IDX, redeemable until December 17, 2026.
Because CareCloud does not have a direct relationship with patients, impacted individuals will likely hear of the company for the first time.
It is recommended to take appropriate action to mitigate the risks arising from the cybersecurity incident and remain on high alert for phishing attempts leveraging the stolen data.
At the time of writing, no ransomware groups or data extortion gangs have taken credit for the attack at CareCloud.
BleepingComputer has contacted CareCloud with questions about the incident and results of the investigation, and we will update this post with the information when we receive it.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
