CareCloud Data Breach Exposes 3.75M Patients’ Records

CareCloud has confirmed that a March data breach exposed the personal information and medical records of more than 3.75 million people, making it one of the largest U.S. health data breaches reported this year.

The New Jersey-based company disclosed the updated number of affected individuals in a filing with the U.S. Department of Health and Human Services. The total was revised upward after CareCloud had previously notified a substantially smaller number of people affected by the incident.

Hackers stole medical and financial information.

CareCloud provides electronic medical record and other healthcare technology services to tens of thousands of healthcare providers across the United States, including hospitals, physicians’ offices and other medical practices. Its systems consequently handle sensitive medical, personal and billing information belonging to millions of patients.

The company first disclosed the breach in March, saying that attackers had accessed patients’ medical information stored in one of its cloud environments for over 6 days. CareCloud later told affected individuals that data had been exfiltrated from its Amazon Web Services account.

The stolen information includes names, mailing addresses, Social Security numbers and medical and health information. The compromised data also includes government identification numbers, such as passport and driver’s license numbers, as well as banking and other financial information.

Healthcare breaches continue to expose millions.

The newly disclosed scale places CareCloud among several major healthcare data breaches reported in 2026. TriZetto disclosed in March that a breach dating to 2024 affected about 3.4 million people. Health technology billing software provider Craneware also experienced a data breach in July, although the number of people affected had not been specified in the source reporting.

DentaQuest has reported the largest healthcare data breach of the year so far, according to the HHS breach tally cited in the reporting. At least 15 million people had personal and health information affected in that incident.CareCloud’s updated disclosure provides the clearest picture yet of the reach of its March breach, with millions of patients potentially affected by the theft of information ranging from medical records to government identification and financial data.