CareCloud Reports Unauthorized Access to EHR Environment; Data Exposure Under Review
Summary
CareCloud reported temporary unauthorized access to one EHR environment on March 16, with access restored the same day after about eight hours. The company is investigating whether patient information was accessed or exfiltrated.
Key points
- CareCloud said an unauthorized third party temporarily accessed one of its EHR environments on March 16.
- The affected environment was unavailable for about eight hours; CareCloud restored access the same day, after a brief operational disruption.
- The company said the incident was limited to one of six CareCloud Health environments and believes the others were unaffected.
- Whether patient information or other data was accessed or exfiltrated remains under investigation; CareCloud has not disclosed how many people may be affected.
- CareCloud engaged an external cyber response team, notified its insurer, and reported the incident to law enforcement.
- CareCloud classified the incident as material because of the sensitivity of potentially affected data; it reported no material financial impact so far.
Article Details
- Victim Organization
- CareCloud
- Incident Type
- Unauthorized third-party access to an electronic health record environment, causing a temporary operational disruption.
- Data Types Exposed
- Patient information or other data may have been accessed; whether any data was accessed or exfiltrated remains under investigation.
- Affected Records
- Not disclosed; CareCloud has not disclosed how many individuals could be affected.
- Affected Data Size
- Not disclosed; the categories and volume of any accessed or exfiltrated data are still being assessed.
- Operational Impact
- One CareCloud Health EHR environment was affected for approximately eight hours. Access was restored and affected systems were brought back online the same day. CareCloud believes its other five environments were unaffected. No material financial impact has been reported so far.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed