CareCloud confirms 3.7M patients had their medical records stolen in data breach

Hackers person stolen the idiosyncratic accusation and aesculapian records of much than 3.75 cardinal radical successful a information breach astatine wellness information elephantine CareCloud, the institution has confirmed with national regulators. The disclosure marks the archetypal confirmation of the standard of the information breach, which is present confirmed to beryllium the fifth-largest theft of wellness information successful 2026 truthful far.

CareCloud elaborate the March information breach successful a filing with the Department of Health and Human Services (HHS) connected Monday. The fig of affected victims was reportedly revised up successful an update connected Tuesday, though it’s unclear if the fig is expected to emergence further.

The New Jersey-based tech institution provides physics aesculapian grounds retention to tens of thousands of healthcare providers astir the United States, consequently serving millions of patients. CareCloud handles a ample magnitude of diligent information and billing accusation connected behalf of hospitals, doctor’s offices, and different aesculapian practices.

CareCloud has not publically commented connected the cyberattack since it disclosed the breach successful March, erstwhile it said hackers had accessed patients’ aesculapian information stored successful 1 of its unreality retention environments implicit six days. The institution aboriginal said in information breach notifications that the hackers exfiltrated information from the company’s Amazon Web Services relationship and stole reams of diligent data.

The stolen information includes patients’ names, postal addresses, Social Security numbers, and their aesculapian and wellness information. The hackers besides took government-issued recognition numbers, specified arsenic passports and driver’s licenses, arsenic good arsenic banking and fiscal information.

CareCloud main enforcement Stephen Snyder has not responded to aggregate emails to day requesting accusation astir the incident, including whether the institution has paid the hackers; who, if anyone, is liable for cybersecurity astatine the company; oregon if Snyder plans to resign pursuing the incident.

The breach astatine CareCloud follows respective sizable healthcare breaches confirmed this year.

Tech elephantine TriZetto confirmed successful March that a 2024 information breach affected 3.4 cardinal people’s data, and an as-yet-unspecified fig of radical person had their information stolen during a July information breach astatine healthtech billing bundle shaper Craneware.

According to HHS’ moving tally of healthcare information breaches, dental security elephantine DentaQuest has had the largest information breach this twelvemonth truthful far, with astatine slightest 15 cardinal people’s idiosyncratic and wellness accusation being affected.