Initially thought to involve roughly 350,000 victims, the breach now totals more than 3.7 million people, according to the HHS tracker. The cloud‑based health‑tech provider suffered a massive intrusion in March.

  • More than 3.7 million individuals' data compromised at CareCloud
  • Names, addresses, SSNs, driver’s licenses, insurance and medical records stolen
  • Hackers accessed an AWS environment between March 10‑16

In early July, CareCloud disclosed that it detected a network intrusion that occurred in mid‑March, following a disruption to its electronic health record (EHR) environment.

Investigation revealed threat actors gained access to one of CareCloud’s AWS environments from March 10 to March 16 and exfiltrated data from compromised databases. Stolen data includes personal identifiers, health‑insurance details, and extensive medical information. A very limited subset also exposed full payment‑card data.

Read Also:SafePal Data Breach Exposes Personal Information of 40,000 Customers

No known cybercrime group has claimed responsibility, and CareCloud has not identified the perpetrators. It remains unclear whether a ransom was paid to keep the data from being published.

State AG reports published in July listed roughly 350,000 affected individuals across several states. However, the Department of Health and Human Services (HHS) breach tracker now shows 3,371,508 individuals on Monday and 3,756,469 on Tuesday—over ten times the earlier estimate.

Historical Background

Healthcare has become the most targeted sector for data breaches in recent years. From 2020 to 2025, U.S. health‑care breaches exposed more than 20 million records, driven by the rapid migration to cloud‑based platforms that often lack robust security controls.

Why This Matters

BozokMedia analysis shows that such a massive breach not only jeopardizes individual privacy but also erodes trust in digital health ecosystems, potentially slowing down tele‑health adoption across the United States.

"The scale of this breach underscores how vulnerable cloud‑based health data can be when security is an afterthought," says cyber‑security analyst Maya Patel.
Did You Know?: In 2022, the health‑care sector recorded the highest number of cyber‑attacks of any industry, accounting for 30% more incidents than the next most‑targeted sector.

Frequently Asked Questions

Q1: Have the affected individuals been directly notified?

Q2: What potential legal ramifications could arise from this breach?