Healthcare information technology company CareCloud is notifying at least 350,000 people that their information was stolen in a data breach. The incident disrupted an electronic health record environment within the CareCloud Health division on March 16, 2026.
The company’s investigation determined that hackers accessed one of its AWS environments between March 10 and March 16 and likely exfiltrated data. On June 24, the investigation confirmed that personal, financial, and medical information was compromised, according to a notification letter filed with Massachusetts regulators.
Potentially affected data includes names, addresses, Social Security numbers, dates of birth, driver’s license numbers, government ID numbers, financial account numbers, credit and debit card numbers, and medical and health insurance information.
CareCloud is offering 24 months of free identity theft protection, credit monitoring, and recovery services that include a $1M insurance reimbursement policy. The company said it secured the affected environment with help from external experts and confirmed no persistent unauthorized access remained. It has not disclosed the total number of impacted individuals or named the threat actor.
