CareCloud Says March Breach Affected 3.76 Million People
Summary
CareCloud reported that unauthorized access to an AWS environment in March affected 3,756,469 people and disrupted its network for eight hours. The attacker claimed database data was exfiltrated; the sample notice specifies full names but not other data types.
Key points
- CareCloud said an unauthorized third party accessed one of its AWS environments between March 10 and 16, 2026.
- The attacker claimed to have exfiltrated data from databases in that environment; the claim is not independently confirmed in the article.
- CareCloud reported an eight-hour network disruption and loss of access to one database.
- A report to the U.S. Department of Health and Human Services lists 3,756,469 people as affected; breach notifications began July 25.
- A sample notification specifies full names but does not identify other exposed data types.
- Affected individuals are being offered 12 or 24 months of identity protection through IDX.
Article Details
- Victim Organization
- CareCloud
- Incident Type
- Data breach involving unauthorized access to a CareCloud AWS environment; the third party claimed to have exfiltrated database data.
- Incident Date
- 2026-03-10
- Data Types Exposed
- Full names
- Patient-related data may have been exposed; the specific data types beyond full names were not specified, and exfiltration was claimed.
- Affected Records
- 3,756,469 people
- Operational Impact
- The incident caused an eight-hour network disruption and cut access to one database.
- Ransom Or Extortion
- No ransomware group or data extortion gang had taken credit for the attack at the time of reporting; no ransom demand was reported.
- Claim Status
- claimed