CareCloud Got Hacked. Your Doctor's Records May Have Gone With It.

45,000 providers. Millions of patients. 8 hours of unauthorized access. And CareCloud still won't say what was taken.

State of Surveillance Editorial Team

Doctor using a laptop computer at a desk in a medical office
Photo via Unsplash

TL;DR: CareCloud, a New Jersey-based healthcare IT company that manages electronic health records for over 45,000 healthcare providers, told the SEC on March 27, 2026 that hackers breached one of its six EHR environments on March 16. They had access for roughly 8 hours. The company says the breach was "contained" and systems were restored the same day, but three weeks later, CareCloud still hasn't said what patient data was accessed, how many people were affected, or how the hackers got in. If your doctor uses CareCloud, your medical records, prescriptions, diagnoses, and insurance information may have been exposed.

What Happened

On March 16, 2026, CareCloud detected what it called a "temporary network disruption" in one of its six electronic health record environments. That's corporate speak for: someone broke in [1].

The unauthorized access lasted approximately 8 hours before CareCloud's team shut it down and restored functionality. The company filed an SEC Form 8-K on March 27 (11 days after the breach) disclosing the incident. The filing says "the incident was contained on the day it was discovered" and that "the threat actor no longer has any access" [1][2].

What the filing doesn't say: what data was taken. Or how many patients are affected. Or how the hackers got in.

Why This Matters: The Vendor Trust Chain

Here's the thing about healthcare data. You pick your doctor. You trust your doctor. But you don't pick your doctor's IT vendor. And you definitely didn't pick CareCloud.

CareCloud serves over 45,000 healthcare providers across the United States [3]. Those providers store patient records (medical histories, diagnoses, prescriptions, insurance details, Social Security numbers) in CareCloud's cloud-hosted EHR platform. Millions of patients' most sensitive information lives on CareCloud's servers.

When CareCloud gets breached, patients don't get a say. Most don't even know their records are stored there. You signed a HIPAA consent form at your doctor's office. You didn't sign up for having your medical history sitting on a platform that a hacker wandered through for 8 hours.

What CareCloud Has (and Hasn't) Said

According to the SEC filing and subsequent reporting, here's what CareCloud has confirmed [1][2][4]:

  • One of six EHR environments was accessed: the CareCloud Health division
  • 8 hours of unauthorized access before systems were restored
  • No other business systems were reportedly affected
  • Law enforcement was notified, cyber insurance carrier contacted
  • A Big Four accounting firm's cybersecurity team was brought in for forensic investigation
  • The company's "initial assessment" says no "material impact" on financial position

And here's what CareCloud hasn't said:

  • What data was accessed or exfiltrated: the company is still "assessing"
  • How many patients are affected: no number provided
  • How the breach happened: attack vector not disclosed
  • Which providers' patients are at risk: no client notification details
  • Whether data was actually stolen or just accessed

Three weeks of "assessing." Meanwhile, if patient data was exfiltrated, it's already on a darknet forum, already being sold, already being used for insurance fraud and targeted phishing [5].

Why EHR Breaches Are Worse Than Regular Data Breaches

When a retailer gets breached, they steal your credit card number. You call your bank, get a new card, move on.

When an EHR platform gets breached, they steal your identity. Electronic health records contain everything an attacker needs [5]:

  • Full names, dates of birth, Social Security numbers: classic identity theft fuel
  • Insurance policy numbers: medical identity fraud lets criminals bill your insurance for fake procedures
  • Medical diagnoses and prescriptions: blackmail material, or used for targeted phishing ("We noticed your prescription for...")
  • Home addresses and contact details: combined with medical info, these enable convincing scams

You can change a credit card number. You can't change your medical history. Stolen health data stays dangerous for years, sometimes decades. And health records sell for 10 to 40 times more than credit card numbers on criminal marketplaces [6].

CareCloud Isn't Alone: The Healthcare Breach Epidemic

This breach didn't happen in a vacuum. Healthcare is getting systematically pillaged. Analysis of HHS Office for Civil Rights breach filings shows 301 million individuals affected across 735 breaches [7]. That's almost every American.

Just in the past few months:

  • Change Healthcare: 192.7 million records. The biggest healthcare breach in history [7].
  • Conduent: 25+ million Americans' benefits data [7].
  • Navia Benefit Solutions: 2.7 million records [7].
  • OpenLoop Health: breach disclosed in April 2026 [6].
  • CareCloud: unknown scope, potentially millions.

The pattern is clear: healthcare IT vendors are soft targets. They store enormously valuable data. They often run on tight margins with underinvested security teams. And when they get breached, patients are the last to find out.

What You Should Do Right Now

If you've visited a doctor, clinic, or hospital that uses CareCloud (and there's no easy way to check) here's your move:

  1. Freeze your credit at all three bureaus (Equifax, Experian, TransUnion). It's free and takes 10 minutes. This blocks anyone from opening accounts in your name.
  2. Check your insurance Explanation of Benefits (EOB) statements for procedures or visits you don't recognize. Medical identity fraud shows up here first.
  3. Monitor the HHS breach portal at ocrportal.hhs.gov for CareCloud's official filing. Once the investigation concludes, affected patients should receive notification letters.
  4. Be suspicious of any healthcare-related emails or calls referencing your medical information. Breached data enables highly targeted phishing.
  5. Ask your healthcare provider what EHR system they use. If it's CareCloud, ask them directly what they know about the breach and whether your data was in the affected environment.

The Accountability Gap

CareCloud's SEC filing includes a line that should make your blood boil: the incident "has had no material impact on the company's operations" and is "not reasonably likely to have a material impact on the company's financial position" [1].

Translation: our stock price is fine. As for the millions of patients whose medical records may have been rifled through? Not a material concern.

This is the accountability gap in healthcare IT. The company that stores your most sensitive data faces minimal consequences when it gets breached. CareCloud files an 8-K with the SEC, hires some consultants, and moves on. Meanwhile, patients face years of identity theft risk from data they never chose to share with CareCloud in the first place.

Until HIPAA enforcement gets actual teeth (with fines that actually hurt and criminal referrals for negligent security) healthcare vendors will keep treating cybersecurity as a cost center instead of a responsibility. And breaches like CareCloud's will keep happening.

Sources

  1. Board Cybersecurity: CareCloud Inc. Cybersecurity Incident, SEC 8-K Filing Details
  2. TechCrunch: Health data giant CareCloud says hackers accessed patients' medical records (March 31, 2026)
  3. Fox News: CareCloud cyberattack raises patient data concerns (April 7, 2026)
  4. UpGuard: CareCloud Data Breach: What Happened and What's at Risk
  5. CyberPress: CareCloud Data Breach: Hackers Access IT Systems, Steal Patient Data
  6. HIPAA Journal: Healthcare Software Company Announces Breach of its Electronic Health Record Environment
  7. HHS OCR Breach Portal: Breach Report