CareCloud says hackers stole medical records of 3.7 million patients
CareCloud, a New Jersey-based provider of cloud electronic health records, told the U.S. Department of Health and Human Services that hackers stole personal and medical information belonging to more than 3.75 million people, a sharp increase from earlier state filings that listed about 350,000.
The revised count makes it one of the largest health data thefts of 2026. The stolen records include Social Security numbers, government ID numbers and medical information, the combination most useful to fraudsters.
What happened
Attackers accessed one of CareCloud's Amazon Web Services environments between March 10 and March 16, 2026, according to SecurityWeek. The company detected the intrusion in mid-March after a disruption to an electronic health record environment, and disclosed it publicly at the time without details. It began notifying affected people in July.
The HHS breach tracker first listed 3,371,508 affected individuals before being updated to 3,756,469, a figure HHS confirmed to SecurityWeek.
According to CareCloud's notices, the stolen data varies by person and includes names, addresses, Social Security numbers, driver's licence numbers, dates of birth, health insurance information and medical information. A very small subset also had full payment card details exposed, SecurityWeek reported. TechCrunch said banking information and passport numbers were also listed for some people.
What we don't know yet
CareCloud has not named the attackers, and no known cybercrime group has claimed the breach. The hackers claimed to have taken data from databases in the compromised environment. It is not known whether the company paid a ransom. Chief executive Stephen Snyder did not respond to TechCrunch's questions, and it is unclear whether the count will rise again.
Context
The breach fits a pattern in 2026 of attackers going after health-care technology vendors that hold data for many clinics at once. TechCrunch noted that the HHS tally lists DentaQuest as the largest health breach of the year so far, with at least 15 million people affected, and that claims processor TriZetto confirmed in March that a 2024 breach affected 3.4 million people.
What to do
Patients who receive a CareCloud letter should enrol in any credit monitoring offered, place a fraud alert with the credit bureaus and review insurance statements for services they did not receive. Expect phishing that references your doctor or clinic by name.
