CareCloud breach exposes data of about 3.7M people

A network intrusion into CareCloud’s Amazon Web Services environment between March 10-16 exposed records for about 3.7 million people, according to records on the Department of Health and Human Services breach tracker.

The data identified as accessed includes names, addresses, Social Security numbers, driver’s license numbers, dates of birth, health insurance information and medical and healthcare records. A very small subset of individuals had full payment card information taken.

CareCloud disclosed in early July that it detected the intrusion in mid-March after a disruption involving an electronic health record environment prompted a review. The company’s internal investigation found threat actors had access to the AWS account during the March 10-16 window and that data was allegedly exfiltrated from databases in the affected environment.

State attorney general filings published in July initially listed tens of thousands of affected individuals across multiple states, producing a combined total near 350,000. The HHS tracker was updated to show 3,371,508 affected and then 3,756,469; HHS confirmed the larger figure reflects the most recent data provided to the agency.

No party has publicly claimed responsibility for the intrusion, and CareCloud has not disclosed whether any ransom was paid. The company has not released a full list of affected clients.

The breach affects patients and healthcare providers that use CareCloud’s cloud services. CareCloud is continuing its investigation, coordinating with law enforcement and notifying affected individuals through state reporting processes.

Officials advise people named in breach notices to monitor financial accounts, review credit reports, consider credit freezes or fraud alerts and follow any specific remediation steps provided in state notifications.