CareCloud Data Breach Exposes 345,000 Patient Files

The CareCloud data breach has reached at least 345,000 people, exposing medical records and other sensitive personal data held by a company that serves more than 45,000 healthcare providers across the U.S.

Patients are now receiving notification letters after hackers accessed one of CareCloud’s electronic health record data stores earlier this year, according to TechCrunch. The New Jersey-based health tech company stores patient records for doctors’ offices, hospitals, and other medical practices, making the breach a vendor-side incident with consequences far beyond a single clinic.

CareCloud data breach notifications put patients and providers on alert

CareCloud first disclosed the incident to regulators on March 27, but new state filings now give a sharper view of the breach. According to a notice filed with California’s attorney general’s office, hackers had access to one of the company’s electronic health record data stores for at least six days, from March 10 to March 16.

The filing said a hacker:

“claimed to have exfiltrated data from databases.”

CareCloud did not say how that claim was made. TechCrunch reported that it is not aware of any ransomware or extortion group publicly taking credit for the CareCloud data breach.

The breach affected data storage hosted on Amazon Web Services, confirming earlier TechCrunch reporting. CareCloud has said hackers raided one of its six stores of patient data, but the company has released little technical detail about how they got in.

The immediate question for providers: how much of the breached store tied back to their own patients?

TechCrunch reported that the breach affects at least 345,000 people across the U.S., based on filings and listings with state attorneys general, including New Hampshire, Massachusetts, Texas, and Maine. That number may rise as more state disclosures are filed.

For healthcare providers that rely on CareCloud systems, the breach creates an uncomfortable dependency problem. A doctor’s office or medical practice may not have been directly hacked, but patient data entrusted to a third-party health tech platform was still exposed.

XOOMAR analysis: The significance is not just the count. It is the role CareCloud plays in the chain. A vendor that stores records for tens of thousands of providers can turn one compromised data store into a multi-state notification event.

Stolen medical, identity, and financial data raises the stakes for patients

The notices confirm that the stolen data included names, postal addresses, Social Security numbers, and government-issued identification numbers, including passports and driver’s licenses.

They also say the stolen data included financial information, such as bank account information and payment card numbers, along with medical and health-related information. That combination is unusually damaging because it links identity, money, and healthcare data in one incident.

The practical question for patients: which exact fields were exposed in their individual case?

CareCloud’s state notices identify broad categories, but affected people will need to read their own letters closely. Not every person necessarily had the same data exposed.

Patients should treat any healthcare-themed message that references the incident with caution. The source material confirms that medical, financial, and identity data were taken, so suspicious calls, emails, or letters asking for payment details, account access, or identity verification deserve extra scrutiny.

Recommended steps for notified patients:

• Read the notice carefully: Look for the exact data categories CareCloud says were tied to your record.
• Watch financial accounts: The notices say bank account information and payment card numbers were included.
• Check medical billing: Report unfamiliar healthcare charges or records to the relevant provider.
• Guard identity documents: Passports, driver’s licenses, and Social Security numbers require longer-term monitoring.
• Verify before responding: Contact providers or CareCloud through known channels, not links or numbers in unexpected messages.

The CareCloud data breach sits in the same broader security category as other incidents where sensitive data is copied before victims understand the full scope. For separate XOOMAR cybersecurity coverage on stolen digital assets and account compromise, see 45 Songs Stolen as Ariana Grande Lawsuit Hunts Hackers and OpenAI Rogue AI Agent Hijacks Accounts After Hugging Face.

Regulators now have filings, but CareCloud has not answered the biggest technical questions

CareCloud chief executive Stephen Snyder did not respond to TechCrunch’s request for comment or questions about the incident. The company’s public posture remains limited, even as notification letters move out and state filings accumulate.

The source material reviewed here does not say whether CareCloud is offering credit monitoring, identity protection, or other support to affected people. It also does not provide a complete forensic timeline beyond the confirmed access window of March 10 to March 16.

The unanswered question for regulators and customers: was the March access window the full intrusion, or only the period CareCloud has confirmed so far?

Several core details remain unresolved:

• Entry point: CareCloud has not said how hackers accessed the AWS-hosted data store.
• Full affected count: TechCrunch says the number is likely to rise as more state filings appear.
• Data variation: Notices list categories, but not whether every affected person had every category stolen.
• Ransomware link: No ransomware or extortion group has publicly claimed responsibility, according to TechCrunch.
• Security controls: The available disclosures do not explain what protections failed or what changes CareCloud has made.

TechCrunch places the incident alongside other healthcare-related breaches this year. It cited a breach at TriZetto affecting 3.4 million people, a month-long breach at NYC Health + Hospitals in which hackers stole 1.8 million people’s health data and thousands of employee fingerprint scans, and a separate incident at Craneware, which said hackers stole a “significant volume” of customer data from its servers.

That context matters, but CareCloud’s case will turn on its own facts. The next filings should show whether the affected population grows materially and whether CareCloud provides more detail on the attacker’s path into the data store.

For now, the watch item is narrow and important: whether future notices expand the confirmed victim count beyond 345,000, and whether CareCloud discloses enough technical detail for providers and patients to judge the remaining risk.

Impact Analysis

• At least 345,000 people had medical records and sensitive personal data exposed.
• Because CareCloud serves more than 45,000 healthcare providers, the breach could affect patients across many practices.
• Hackers accessed an electronic health record data store for at least six days, raising questions about provider and patient exposure.