Key facts
- CareCloud confirmed a data breach affecting over 3.75 million patients.
- The breach is the fifth-largest theft of health data in 2026.
- Stolen data includes names, addresses, Social Security numbers, and medical information.
- Hackers also obtained government-issued identification numbers and financial details.
- The breach occurred over six days in March, accessing data stored in CareCloud's AWS account.
CareCloud has confirmed that a data breach has compromised the personal and medical records of over 3.75 million individuals. This incident is now recognized as the fifth-largest theft of health data in 2026. The company, which provides electronic medical record storage to healthcare providers across the United States, disclosed the breach to federal regulators on Monday, with the number of affected victims reportedly revised upward on Tuesday.
The breach, which occurred in March, involved hackers accessing patient data stored in CareCloud's cloud environment over a six-day period. The stolen information includes names, postal addresses, Social Security numbers, medical and health information, government-issued identification numbers, and banking and financial details. CareCloud has not publicly commented on the incident since its initial disclosure in March.
This breach follows several other significant healthcare data thefts this year. Tech giant TriZetto confirmed a breach affecting 3.4 million people in March, and healthtech billing software maker Craneware experienced a breach in July. DentaQuest, a dental insurance giant, reported the largest breach so far in 2026, impacting at least 15 million people.