CareCloud confirmed a network intrusion exposed the personal and medical records of approximately 3.7 million patients. An unauthorized party accessed one of the company’s Amazon Web Services (AWS) environments for one week in mid-March 2026.
Stolen information includes patient names, addresses, Social Security numbers, and driver’s license numbers. The breach also compromised dates of birth, health insurance details, and medical information. A smaller subset of individuals had full payment card details exposed.
Updated figures on the Department of Health and Human Services (HHS) breach tracker revealed the new total. The scale of the incident is significantly higher than the 350,000 victims initially reported in July.