CareCloud Breach Affected 3.76 Million Individuals, HHS Confirms
Summary
CareCloud says attackers accessed an AWS environment in March. HHS confirmed the breach affected 3,756,469 individuals; exposed information included personal, health, and, for a limited subset, payment-card data.
Key points
- CareCloud said attackers accessed an AWS environment from March 10 to March 16 after a network intrusion detected in mid-March.
- The company said the attackers claimed to have exfiltrated information from databases in the environment.
- Exposed information included names, addresses, Social Security numbers, driver's license numbers, birth dates, insurance details, and medical information.
- A limited subset of affected individuals also had full payment-card information exposed.
- HHS's tracker rose from 3,371,508 to 3,756,469 affected individuals; HHS confirmed the higher figure was accurate and reflected its latest data from CareCloud.
- CareCloud has not identified the attackers, and whether it paid a ransom is unclear.
Article Details
- Victim Organization
- CareCloud
- Incident Type
- Network intrusion and data breach
- Data Types Exposed
- Names
- Addresses
- Social Security numbers
- Driver’s license numbers
- Dates of birth
- Health insurance information
- Medical and healthcare information
- Full payment card information for a very limited subset of individuals
- Affected Records
- 3,756,469 individuals, according to the HHS tracker; HHS confirmed the figure was accurate and based on the most recent data provided to the agency.
- Operational Impact
- The breach was discovered following a disruption involving an electronic health record environment.
- Ransom Or Extortion
- The attackers claimed to have exfiltrated database information, according to CareCloud. It is unclear whether CareCloud paid a ransom to prevent the data from being made public.
- Claim Status
- confirmed