CareCloud Inc., a New Jersey-based healthcare technology company, has disclosed a significant cybersecurity incident affecting approximately 345,000 to 350,000 individuals after unauthorized actors gained access to one of its AWS-hosted electronic health record environments. The breach occurred on July 1, 2026, and exposed sensitive information such as patient health, insurance, and in some cases, financial data across the company's healthcare provider network. Initial disclosures in late March indicated an eight-hour service disruption with CareCloud restoring functionality on the same day, initially stating uncertainty about whether sensitive data had been exfiltrated.
By June 24, 2026, however, a deeper forensic review confirmed that affected individuals' data included full names combined with additional details like home addresses, dates of birth, Social Security numbers, driver's license numbers, health insurance member numbers, insurer names, policy and group numbers, primary care and referring physician information, medications, allergies, and other demographic and health insurance details. to 5 p.m. For individuals seeking assurance regarding their personal information's involvement in the incident, CareCloud advises affected parties to place a one-year fraud alert on their credit reports at Equifax, Experian, or TransUnion. The breach highlights growing concerns about cloud-hosted healthcare infrastructure being targeted by cybercriminals who often exploit vulnerabilities in third-party SaaS environments that aggregate protected health information from multiple provider organizations simultaneously.
