A significant healthcare data breach at CareCloud has compromised the personal and medical records of more than 3.75 million individuals, according to a notice filed with the California Attorney General. The incident, which occurred earlier this year, saw hackers gain access to a CareCloud cloud environment, exposing sensitive information that could facilitate identity theft and medical fraud.
The breach dates back to March 2026, when CareCloud detected a network disruption on March 16. The company engaged cybersecurity experts to investigate, who determined that an unauthorized third party had accessed one of its Amazon Web Services environments between March 10 and March 16, 2026. The attacker reportedly exfiltrated data from databases within that environment. CareCloud stated that there was no evidence of continued unauthorized activity after March 16.
Initially, disclosures indicated a smaller number of affected individuals, but the figure has since climbed dramatically. The data stolen varies by individual but may include names, postal addresses, Social Security numbers, medical and health information, driver's license numbers and other government-issued IDs, and banking and financial information. This broad scope of compromised data poses a significant risk for identity theft, financial fraud, and medical identity theft.
Medical identity theft occurs when a criminal uses another person's information to obtain medical services or prescriptions. This can result in fraudulent insurance claims appearing under the victim's name and potentially lead to inaccurate information being added to their medical records, creating long-term health and financial complications.
Following the discovery of the breach, CareCloud engaged external cybersecurity specialists, reported the incident to law enforcement, and secured the affected environment. The company is offering affected individuals complimentary identity protection services through IDX. Those who received a notification letter are advised to review the terms and enrollment deadlines for these services.
Experts recommend several steps for individuals affected by the breach. These include carefully reviewing the breach notification letter to understand the specific types of information exposed, freezing credit with major bureaus if a Social Security number was compromised, and closely monitoring bank accounts, credit cards, and credit reports for suspicious activity. It is also crucial to review medical records and insurance explanations of benefits for any unfamiliar providers, procedures, or claims, as medical identity fraud may not trigger traditional credit alerts. Securing online accounts with strong, unique passwords and enabling two-factor authentication is also advised. Additionally, maintaining updated antivirus software and being wary of personalized scams that leverage stolen personal details can help mitigate further risks. Reporting any discovered identity theft promptly to the Federal Trade Commission's IdentityTheft.gov is essential for initiating a recovery plan.