Healthcare information technology company CareCloud is notifying at least 350,000 people that their information was stolen in a data breach.
The incident involved an electronic health record environment within the CareCloud Health division, which was disrupted on March 16, 2026.
CareCloud’s investigation determined that hackers accessed one of its AWS environments between March 10 and March 16, and likely exfiltrated data from it.
On June 24, the investigation determined that personal, financial, and medical information was compromised in the incident, the company notes in the notification letter sent to the potentially affected individuals, a copy of which was filed with the Massachusetts Office of Consumer Affairs and Business Regulation.
The potentially affected information, it says, includes names, addresses, Social Security numbers, dates of birth, driver’s license numbers, government ID numbers, financial account numbers, credit/debit card numbers, and medical and health insurance information.
For a limited number of individuals, the compromised data also included full credit card information, including CVV, the company notes in an incident notification. CareCloud says it has no evidence that the stolen data has been misused.
Based on filings with the Attorney General’s Offices in several states, at least 350,000 individuals have had their information stolen.
The company is providing them with up to 24 months of free identity theft protection, credit monitoring, and ID theft recovery services, which include a $1,000,000 insurance reimbursement policy.
“CareCloud engaged external cybersecurity experts and, with their assistance, secured the affected environment, eliminated the threat, and confirmed that no persistent unauthorized access remained. CareCloud is continuing to strengthen the security of its systems and environments,” the company says.
The healthcare organization has yet to share the total number of impacted individuals and details on the threat actor responsible for the attack. SecurityWeek has emailed CareCloud for additional details and will update this article if the company responds.
*Updated with additional information and link to CareCloud’s incident notice.
Related: Semiconductor Firm Analog Devices Discloses Data Breach
Related: ShinyHunters Claims Ernst & Young Hack
Related: Origin Energy Data Breach Affects 900,000 Australians
Related: Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack
