Hackers have stolen the personal information and medical records of more than 3.75 million people in a data breach at health data giant CareCloud, the company confirmed to federal regulators. The disclosure marks the first confirmation of the scale of the data breach, which is now confirmed to be the fifth largest health data theft in 2026 so far.
CareCloud detailed the March data breach in a presentation submitted to the Department of Health and Human Services (HHS) on Monday. The number of victims affected was supposedly revised upwards in an update on Tuesday, although it is unclear if the figure is expected to rise further.
The New Jersey-based technology company provides electronic medical record storage to tens of thousands of healthcare providers across the United States and consequently serves millions of patients. CareCloud handles a large amount of patient data and billing information on behalf of hospitals, doctors’ offices, and other medical offices.
CareCloud has not commented publicly on the cyberattack since revealing the rape in Marchwhen it said hackers had accessed patients’ medical data stored in one of its cloud storage environments for six days. The company later said in data breach notifications that hackers extracted data from the company’s Amazon Web Services account and stole a large amount of patient data.
The stolen data includes patient names, mailing addresses, Social Security numbers, and their health and medical information. The hackers also took government-issued identification numbers, such as passports and driver’s licenses, as well as banking and financial information.
CareCloud CEO Stephen Snyder has not responded to several emails to date requesting information about the incident, including whether the company paid the hackers; who, if any, is responsible for cybersecurity in the company; or if Snyder plans to resign after the incident.
The CareCloud breach follows several major healthcare breaches confirmed this year.
Tech giant TriZetto confirmed in March that a data breach in 2024 affected the data of 3.4 million people, and an as-yet unspecified number of people had their data stolen. during a data breach in July at healthcare technology billing software maker Craneware.
According to HHS’ tally of healthcare data breaches, dental insurance giant DentaQuest has suffered the largest data breach this year so far, with at least 15 million people’s personal and health information affected.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.