CareCloud data breach: what happened and what to do

What happened

CareCloud sells electronic health record and practice management software to medical practices. According to press coverage of its notice, an unauthorized party got into one of its Amazon Web Services environments between March 10 and March 16, 2026, and claimed to have copied data from databases there. The problem surfaced on March 16, when a disruption hit an electronic health record environment. CareCloud says it has seen no unauthorized activity since that date, and no group has publicly claimed the attack.

The company identified which protected health information was involved on June 24, 2026, and began mailing letters on July 25. The HHS breach portal lists 3,756,469 people affected. Early state filings showed a much smaller figure, around 345,000 to 350,000, and the count grew once the review finished. The HHS number is the later one.

What was exposed

Reported categories include names, addresses, dates of birth, Social Security numbers, driver's license and other government ID numbers, financial account numbers, payment card numbers, and medical and health insurance information. It varies by person. For a very small group, full payment card details were exposed.

That mix is unusually broad for one breach. Most healthcare breaches involve identity and insurance data; this one also reached bank and card numbers for some people.

What that lets criminals do

Identity data like a Social Security number plus a date of birth supports new-account fraud, fake tax returns and loan applications. A driver's license number helps a criminal pass identity checks with a bank or phone carrier.

Medical and insurance details are useful for medical identity theft, where someone gets care or files claims under your name. They also make phishing convincing. A caller who knows your doctor's practice and a recent diagnosis code sounds legitimate, which is why you should hang up and call back on a number you look up yourself.

Where bank or card numbers were involved, the risk is direct: unauthorized charges and withdrawals. Your bank can replace a card quickly and watch an account, and that's worth doing before any harm shows up.

The company's response

CareCloud mailed notice letters starting July 25, 2026. The sample letter offers 12 or 24 months of identity protection through IDX, with an enrollment deadline of December 17, 2026, according to coverage of the notice. Check your own letter for the terms that apply to you, since the offer can differ by person.

Notification came roughly four months after the intrusion, a gap that is common in vendor breaches because the vendor has to work out which of its customers' patients were in the stolen data.

How to protect yourself

If you got a letter, read it for the items that were yours, enroll in the offered protection, and freeze your credit if a Social Security number or government ID was listed. If a card or account number was involved, call the bank and ask for a replacement. Verify any message about the breach by going to your provider's website directly, not through a link.