← Carecloud

2026 CareCloud — AWS EHR breach Mar 10–16; 3.76M (HHS OCR); PHI/SSNs/cards

2026 3.8M records affected Share on X

Data compromised

Names, addresses, SSNs, DOBs, driver’s license/government IDs, financial account numbers, credit/debit cards; medical and health insurance information; limited individuals also full card data including CVV (per company notice)

Technical writeup

Verified company notifications plus HHS OCR census revision — August 19, 2026. CareCloud Inc. confirmed hackers accessed one AWS EHR environment between March 10 and March 16, 2026. June 24 investigation found personal, financial, and medical information compromised and likely exfiltrated. Early July–August state AG filings summed to roughly 350,000 individuals (e.g. ~270,197 Texas). SecurityWeek (19 August 2026) reports the HHS breach portal updated to 3,756,469 affected individuals — HHS confirmed the figure to SecurityWeek as accurate per CareCloud’s latest filing, a ten-fold increase over initial AG stubs that still show lower per-state counts. Fields include names, addresses, SSNs, DOBs, driver’s licenses, health insurance, medical data; limited individuals also full card data including CVV. No ransomware group claimed credit; CareCloud offers up to 24 months identity protection. recordsAffected 3756469 from HHS OCR via SecurityWeek.

Root cause

Unauthorized access to one CareCloud Health EHR AWS environment March 10–16, 2026 (disrupted March 16); investigation determined June 24 that personal/financial/medical data were compromised and likely exfiltrated

References