CareCloud breach now confirmed to hit 3.75m people

A data breach at health technology giant CareCloud has ballooned in scale, with the company confirming to federal regulators that more than 3.75 million people had their personal information and medical records stolen.

The disclosure, filed with the Department of Health and Human Services, marks the first official confirmation of the breach's true size, more than ten times earlier estimates, and places it as the fifth-largest health data theft of 2026 so far.

CareCloud has documented the event in an HHS filing on Monday, with the number of affected people having been updated the next day.

Based in New Jersey, CareCloud stores medical records in the cloud for more than 45,000 medical practitioners nationwide, and hence the breach affects people far beyond those directly using the service provided by the company.

The breach was disclosed by CareCloud in March, when it stated that hackers had accessed medical data of the patients stored on their cloud environment over the span of six days.

The company confirmed in July that the hackers had stolen the data from its Amazon Web Services environment. The stolen information includes names, postal addresses, social security numbers, medical records, government IDs, such as passports and driver's licences, and banking information.

The CareCloud breach has not been addressed publicly by the firm since its revelation. The chief executive of the firm, Stephen Snyder, has refused to respond to multiple queries regarding the payment made to the hackers, the party responsible for its cybersecurity, and his future plans at the firm.

The CareCloud breach comes at a time when there have been several high-profile healthcare breaches in 2026. In March, TriZetto confirmed that the 2024 breach had compromised the personal information of 3.4 million patients.

In July, billing software firm Craneware revealed another breach but did not reveal how many patients had their data compromised.