CareCloud breach estimate rises to 3.75 million people

The number of people listed as affected in the CareCloud healthcare-data breach has risen to 3,756,469, far above the roughly 345,000 to 350,000 people identified in earlier notices and reports.

The revised figure appears in the U.S. Department of Health and Human Services Office for Civil Rights breach portal. HHS lists CareCloud, Inc., as a New Jersey business associate reporting a hacking or information-technology incident. The breach submission date shown in the federal record is July 24, 2026.

For people who received an earlier CareCloud notice, the updated figure means the first estimate should not be assumed to represent the final scope. The HHS number is an affected-population count. It does not establish that every person had an entire medical record stolen or that the same information was exposed for everyone.

Why the CareCloud count changed

Earlier state disclosures and reporting put the potentially affected population at approximately 345,000 to 350,000 people. Independent reporting in August described the later federal total as roughly 3.75 million.

CareCloud provides electronic-record and healthcare technology services to providers across the United States. Because the company supports providers in multiple states, the incident is not necessarily limited to New Jersey residents, even though HHS lists the company in New Jersey.

What happened in March

CareCloud’s March 24 Form 8-K said the company discovered a temporary network disruption on March 16. The disruption affected functionality and data access in one of six electronic health record environments for approximately eight hours before service was restored.

In that initial filing, CareCloud said it was still determining whether information had been accessed or exfiltrated. The company’s later Form 10-Q said unauthorized access began approximately one week before the March 16 discovery and that subsequent forensic analysis indicated an undetermined amount of data was exfiltrated.

State disclosures and independent reporting describe access to an AWS-hosted or cloud-supported patient-data environment during approximately March 10 through March 16. CareCloud said the incident was contained and that it believed the threat actor no longer had access. That remains the company’s assessment, not an independent finding.

What information may be involved

Independent reports and breach notifications have described potentially exposed information including names, postal addresses, Social Security numbers, government-issued identification numbers, bank-account or payment-card information, and medical or health information.

The combination of health information with identity and financial details can create long-term risks. Those include identity theft, medical identity theft, insurance fraud and targeted phishing that uses personal healthcare details to appear credible.

What affected people should do now

Verify communications independently. Do not use links or phone numbers in a suspicious email, text or letter. Contact CareCloud or the relevant healthcare provider through a trusted website, statement or previously known number.
Review credit activity. Check credit reports and account statements for unfamiliar activity. Consider placing a fraud alert or credit freeze with the major credit bureaus.
Watch medical records and insurance statements. Look for unfamiliar services, prescriptions or insurance claims.
Secure reused passwords. Change passwords reused on affected accounts and enable multifactor authentication where available.
Keep documentation. Save breach notices, account records and correspondence. They may help with disputes, identity-theft reports or future claims.

The Federal Trade Commission directs consumers affected by data breaches to monitor accounts, consider credit protections and use federal identity-theft recovery resources if misuse appears.

What remains unknown

The public filings do not establish the exact amount or categories of data exfiltrated for each person. CareCloud’s Form 10-Q also says the company has been served with two patient class-action complaints and anticipates possible additional complaints. Those are company-reported legal matters, not adjudicated findings of wrongdoing.

The investigation and notification process may continue. People who received an earlier notice should follow updates from HHS, the FTC, CareCloud and their healthcare providers rather than treating the original estimate as final.

Sources

Look for updates to this story

Discover more from Interactive News

Subscribe to get the latest posts sent to your email.