Healthcare data breach exposes 3.75M patient records

Key Points:

• Over 3.75 million people had their personal and medical information stolen in a CareCloud data breach that occurred in March 2026, involving unauthorized access to an Amazon Web Services environment used by the company.
• CareCloud provides electronic medical record technology to numerous healthcare providers, meaning individuals may be affected even without a direct CareCloud account, as their data was handled through healthcare providers using CareCloud's systems.
• The stolen data includes sensitive details such as names, Social Security numbers, medical records, government-issued IDs, and financial information, raising risks of identity theft, financial fraud, and medical identity theft.
• CareCloud has offered affected individuals complimentary identity protection services and has taken steps to contain the breach, but experts advise victims to freeze credit, monitor financial and medical records, use strong passwords and antivirus software, and be vigilant against personalized scams.
• The breach highlights concerns about patients' lack of control over where their medical data is stored and used, prompting calls for greater transparency from healthcare providers regarding third-party access to medical records.