The compromised information may include names, residential addresses, dates of birth, Social Security numbers, driving licence and passport details, medical record numbers and health insurance information. Clinical data such as diagnoses, treatment details, prescription information, laboratory results and provider names may also have been exposed.
Financial information potentially affected includes bank account details, payment card numbers, expiration dates, security codes, billing records and claims data. The information involved varies among individuals, meaning not every category was compromised for every affected patient.
The intrusion occurred within an Amazon Web Services environment supporting one of CareCloud’s six electronic health record systems. A forensic investigation determined that the attacker had access between March 10 and March 16, 2026, and likely removed files containing patient information.
CareCloud detected the incident on March 16 after a network disruption impaired functionality and access to data. The operational interruption lasted about eight hours before the company restored the affected environment that evening. The longer access period identified later indicates that the intruder may have entered the system several days before the visible disruption alerted the company.
The healthcare technology provider initially disclosed the incident to securities regulators in late March. At that stage, it confirmed unauthorised access but had not determined whether patient records had been copied or removed. Subsequent analysis established that data exfiltration had probably occurred, leading to notifications filed with state authorities and letters to affected individuals.
The known total is expected to change as additional regulatory notices are processed. State filings have already placed the number of people affected above 345,000, while some counts indicate that the figure could exceed 350,000.
CareCloud said the attacker’s access was contained on the day the disruption was discovered. Other company divisions, platforms and information technology environments were not believed to have been affected. No criminal group has publicly claimed responsibility, and the company has not identified the method used to enter the AWS-hosted system.
External cybersecurity specialists were engaged to secure the environment, investigate the intrusion and determine the scope of the compromised information. The incident was also reported to law enforcement and CareCloud’s cybersecurity insurer. Additional safeguards have since been introduced to strengthen the company’s systems and reduce the risk of another unauthorised entry.
The company has offered affected individuals complimentary identity-monitoring and fraud-protection services. Recipients have been advised to review credit reports, bank statements, medical bills and health insurance explanations of benefits for unfamiliar activity.
The breadth of information exposed creates risks beyond conventional payment fraud. Social Security numbers and identity documents can be used to open accounts or obtain credit, while medical and insurance details may support fraudulent claims, prescription scams or highly targeted phishing attempts.
Unlike payment card credentials, which can be cancelled and replaced, medical histories and permanent identifiers may retain value for criminals for years. Combining clinical details with identity and financial information can also make fraudulent messages appear convincing because attackers can refer to genuine healthcare providers, treatments or insurance arrangements.
CareCloud, based in Somerset, New Jersey, supplies cloud-based electronic health records, medical billing, practice-management and revenue-cycle services. Its technology supports tens of thousands of healthcare providers across numerous medical specialties, giving the company access to large volumes of protected patient information.
The incident underscores the growing exposure created by healthcare organisations’ reliance on interconnected cloud platforms and outside technology providers. A breach at one software company can affect patients treated by numerous independent clinics and practices, even when those healthcare providers’ own networks have not been penetrated.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
