...
By Amanda Greenwood
Associate News Editor
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
CareCloud, a U.S.-based health care technology company that provides electronic health record (EHR) systems to tens of thousands of medical providers, has confirmed a cybersecurity incident involving unauthorized access to one of its systems.
The company reported that the incident occurred on March 16, 2026, and affected one of six environments used to store electronic medical records. The disruption lasted for more than eight hours before CareCloud said it restored functionality the same day.
What Happened During the Breach
...
Read More on News
According to a filing with the U.S. Securities and Exchange Commission, CareCloud detected unauthorized third-party access to a single EHR environment within its CareCloud Health division.
While the company said it believes the threat was contained and has since been removed, it acknowledged that the affected system stores patient information, prompting an ongoing forensic investigation into whether data was accessed or exfiltrated.
CareCloud has not disclosed how many individuals may ultimately be affected, stating that the scope of the incident remains under review.
The company emphasized that no other CareCloud platforms, systems, or environments were impacted.
Scale of Potential Impact
Fox News reports that CareCloud supports more than 45,000 health care providers across the United States, including physician practices, clinics, and hospital systems.
Because many patients may not be directly aware that their provider uses CareCloud’s software, cybersecurity experts have warned that affected individuals could be unaware that their data may be involved.
IBTimes reported that much of CareCloud’s infrastructure is hosted on Amazon Web Services (AWS), which is an industry-standard cloud provider commonly used by health care organizations. While cloud hosting itself is not unusual, the incident has renewed broader concerns about cybersecurity risks in centralized health care IT systems, especially ones that store large volumes of sensitive personal and medical information.
Why Health Care Data Is a Frequent Target
Health care records often contain details such as names, dates of birth, insurance information, and medical histories. Unlike credit card data, health care information cannot be easily replaced, making it particularly valuable to bad actors for identity theft, insurance fraud, or targeted scams, according to IBTimes.
Legal and Patient Response
Class Action U reports that law firms are investigating whether affected individuals may be eligible to participate in litigation related to the incident. While CareCloud has said there is no confirmed evidence of data misuse, impacted patients are being encouraged to monitor financial statements, review medical records, and consider placing fraud alerts or credit freezes as a precaution.
CareCloud has also stated it is working with external cybersecurity specialists and law enforcement as the investigation continues and says it “has sufficient cybersecurity insurance coverage for any potential losses."
What Happens Next
At the time of publishing, CareCloud says the breach has “not had a material impact" on its operations, though the investigation remains ongoing, adding that “all affected systems have been fully restored, and the threat actor no longer has any access to the same."
View 0 Comments
Submit Correction
View Editorial & AI Guidelines