CareCloud data breach overview:
- Who: CareCloud Inc. announced a data breach update affecting more than 3.75 million patients nationwide.
- Why: An unauthorized third party accessed one of CareCloud’s Amazon Web Services (AWS) environments and may have stolen patient data, including Social Security numbers, financial account details and medical records.
- Where: The CareCloud data breach affects people throughout the United States.
CareCloud has given further confirmation of a data breach affecting more than 3.75 million patients nationwide. The company first disclosed the incident to the U.S. Securities and Exchange Commission in March.
The full scope of the breach was confirmed when it was added to the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights breach portal, which now lists 3,756,469 affected individuals.
CareCloud provides cloud-based electronic health records, billing and clinical documentation services to healthcare providers across the country.
According to the CareCloud data breach notice, the company detected a network disruption in its CareCloud Health division on March 16 that disrupted one of its six electronic health record environments.
An investigation determined an unauthorized third party had accessed one of CareCloud’s AWS environments between March 10 and 16, and the intruder “claimed to have exfiltrated data from databases within that environment.”
By June 24, CareCloud determined the compromised information varied by individual but could include full names paired with addresses, dates of birth, Social Security numbers, driver’s license or other government ID numbers, financial account numbers, credit or debit card numbers and medical or health insurance details.
CareCloud offers consumers protection services at no cost
Notification letters began going out in July, offering 12 or 24 months of complimentary identity theft protection through IDX.
CareCloud says it is not aware of any reports of identity fraud or misuse of information resulting from the data breach. The company states it has eliminated the threat and found no evidence of further unauthorized activity since March 16.
Individuals affected by the CareCloud data breach can enroll in free IDX identity protection, which includes credit monitoring and a $1 million insurance reimbursement policy, at app.idx.us/account-creation/protect before the Dec. 17 deadline, or by calling IDX at 866-329-9984, Monday through Friday from 9 a.m. to 9 p.m. ET.
Consumers can also check CareCloud’s listing on the HHS Office for Civil Rights breach portal to confirm details of the incident.
CareCloud says it has not received reports of identity theft or fraud connected to the breach. The company is not currently facing legal action over the data breach, but Top Class Actions follows data breaches closely as they sometimes lead to class action lawsuits.
Meanwhile, Unlimited Technology Systems notified more than 3.8 million patients in July that their personal and protected health information may have been exposed in an October 2025 data breach.
Were you affected by the CareCloud data breach? Let us know in the comments.
Don’t Miss Out!
Check out our list of Class Action Lawsuits and Class Action Settlements you may qualify to join!
Read About More Class Action Lawsuits & Class Action Settlements:
