CareCloud confirms 3.75 million patient records stolen in data breach

The confirmation came in a filing with the Department of Health and Human Services on Monday. The figure was revised upward in an update on Tuesday, according to TechCrunch, though it is unclear whether the number will grow further.

CareCloud, based in New Jersey, provides electronic medical record storage to tens of thousands of healthcare providers across the country, serving millions of patients. The company handles patient data and billing information on behalf of hospitals, doctor's offices, and other medical practices.

The company has not publicly commented on the cyberattack since it disclosed the breach in March, when it said hackers had accessed patients' medical data stored in one of its cloud storage environments over six days. In subsequent data breach notifications, CareCloud said the hackers exfiltrated data from its Amazon Web Services account and stole large volumes of patient data.

The stolen data includes patients' names, postal addresses, Social Security numbers, medical and health information, government-issued identification numbers such as passports and driver's licenses, and banking and financial information.

CareCloud chief executive Stephen Snyder has not responded to multiple requests for information about the incident, including whether the company paid the hackers, who is responsible for cybersecurity, or whether Snyder plans to resign, TechCrunch said.

The breach follows several large health data breaches confirmed this year. Tech giant TriZetto confirmed in March that a 2024 data breach affected 3.4 million people's data. An unspecified number of people had their data stolen during a July breach at healthtech billing software maker Craneware. According to HHS's running tally of healthcare data breaches, dental insurance giant DentaQuest has had the largest breach this year so far, affecting at least 15 million people.