CareCloud Data Breach Investigation

CareCloud, a New Jersey healthcare tech company that handles electronic health records and billing for more than 45,000 providers, has confirmed a data breach that hit roughly 3.75 million individuals.

In March 2026 the company reported a network disruption after discovering that someone had gotten into one of its electronic health record systems running on Amazon Web Services. The investigation later showed the unauthorized access lasted several days in mid-March. A threat actor claimed to have taken data, though no group has publicly taken credit. That kind of silence usually means a quiet ransom conversation is happening behind the scenes. CareCloud hasn’t confirmed whether that’s the case.

What CareCloud Data Was Stolen?

The information that was exposed may include the following: full names, home addresses, dates of birth, Social Security numbers, driver’s license or other government ID numbers, financial account and payment card details, plus medical and health insurance records.

Because CareCloud works as a business associate for thousands of medical practices, a lot of the people affected never had a direct relationship with the company. Their doctors or clinics used CareCloud’s systems, and that was enough. Some patients are being offered identity theft protection, but only in states where the law forces the company to provide it. Everyone else is largely on their own.

When a healthcare vendor loses control of this much personal and medical data, the fallout can drag on for years . If you received a notification letter from CareCloud, don’t ignore it. Pull your credit reports and watch your bank and credit card statements carefully.

If your information was involved, data breach lawyers at The Lyon Firm can talk you through your options. We’ve handled data breach cases for people across the country and we work on contingency, so you don’t pay unless we recover money for you. Reach out anytime for a free, confidential consultation.