CareCloud Data Breach Exposes Patients’ Health, Social Security and Credit Card Data

CareCloud has reported a data security incident involving unauthorized access to its Amazon Web Services (AWS) environment that supports the CareCloud Health division.

This incident disrupted one of the company’s electronic health record (EHR) systems. It may have exposed a wide range of protected health information (PHI), personally identifiable information (PII), insurance details, and, for a limited group of individuals, complete payment card information, including CVV codes.

CareCloud Data Breach

According to CareCloud’s notification, the company detected a network disruption on March 16, 2026, and immediately began responding to the incident.

They engaged an external cybersecurity advisory team to secure the affected systems, conduct a forensic investigation, assess the extent of the breach, and report the incident to law enforcement.

The investigation revealed that an unauthorized third party accessed one of its AWS environments between March 10 and March 16 and claimed to have exfiltrated data from the hosted databases.

CareCloud stated that there has been no evidence of continued unauthorized activity in its environment after March 16.

However, the delayed identification and assessment process underscores a recurring challenge in cloud security breaches: determining exactly which database records were accessed or copied after an attacker gains access to a healthcare-workload environment.

The company completed its assessment of potentially affected data on June 24, more than three months after the suspected access period ended.

The data at risk varies by individual but may include full names, home addresses, birth dates, Social Security numbers, driver’s license numbers, health insurance member identifiers, insurer names, policy and group numbers, information about primary care and referring physicians, details about medications, allergies, and other demographic and health insurance records.

CareCloud also confirmed that a very limited number of affected individuals may have had their full credit card information, including CVV data, exposed.

The combination of health, identity, insurance, and financial data creates significant potential risks. Malicious actors can use such information for identity theft, insurance fraud, account takeover, targeted phishing, and medical identity fraud.

Additionally, healthcare-related information can make social engineering attempts more convincing, particularly when attackers have details about a patient’s provider, prescriptions, insurer, or policy information.

At the time of its notification, CareCloud reported that it was not aware of any confirmed cases of identity fraud or improper data use linked to the incident.

In response to the incident, CareCloud stated that it contained and remediated the issue, secured the affected environment, eliminated the identified threat, and confirmed that no persistent unauthorized access remains.

The company is also taking further steps to strengthen its systems and environments. Affected individuals are being offered complimentary IDX identity protection services, which include credit and CyberScan monitoring, identity theft recovery support, and a $1 million insurance reimbursement policy. The deadline for enrollment in these services is December 17, 2026.

CareCloud advises impacted individuals to monitor their financial statements, review their credit reports, consider placing a one-year fraud alert, and utilize security freezes where appropriate.

Patients should also review their explanation of benefits statements and inquire with insurers or providers about any unfamiliar services, as these measures can help detect potential medical identity fraud.

Individuals with questions can contact CareCloud’s dedicated response line at 800-411-9670, available Monday through Friday from 9 a.m. to 5 p.m. Eastern Time.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.