CareCloud Data Breach Exposes Data: 411k+ Patients Impacted

CareCloud Inc., a healthcare information technology company based in Somerset, New Jersey, experienced a data breach in March 2026 that exposed sensitive patient information that has so far affected 270,197 Texas residents, 72,102 Massachusetts residents and 68,886 New Hampshire residents.

CareCloud provides cloud-based electronic health records, revenue cycle management and other clinical documentation services to healthcare organizations across the United States, serving more than 40,000 providers.

Between March 10 and March 16, 2026, an unauthorized third party accessed one of CareCloud's AWS cloud environments within its CareCloud Health division.

The breach caused a temporary network disruption that impacted one of CareCloud's six electronic health record environments before the company fully restored all functionality and data access.

In an 8-K filing with the SEC on March 24, 2026, CareCloud stated that the incident was contained to the CareCloud Health environment and did not affect its other platforms, divisions, systems or data.

The company's forensic investigation found no evidence of unauthorized activity within CareCloud's environment after March 16, 2026.

On June 24, 2026, CareCloud determined that the affected data may have included individuals' full names, protected health information, Social Security numbers, financial information, driver's licenses and credit or debit card numbers.

CareCloud's response to the breach

CareCloud is offering affected individuals identity theft protection services through IDX.

Affected individuals can enroll by calling 866-329-9984 or visiting the IDX enrollment page using the enrollment code provided in their notification letter. The enrollment deadline is Dec. 17, 2026.

CareCloud has also set up a dedicated toll-free response line staffed with professionals familiar with the incident. The line is available Monday through Friday from 9 a.m. to 5 p.m. Eastern Time.