What is known about the CareCloud data breach disclosed in August 2026—including how more than 3.75 million patients were affected, when and how hackers accessed and exfiltrated records from the company’s Amazon Web Services cloud environment, what types of personal, medical, ide

CareCloud has reported that hackers stole personal and medical records of 3,756,469 people, making this the fifth-largest reported U.S. healthcare-data breach of 2026 so far. The figure was far above the roughly 345,000 people initially notified. 2

• What happened: CareCloud said attackers accessed one of its cloud-storage environments for six days during March 2026, then exfiltrated data from its Amazon Web Services account. The company had disclosed a network disruption in March; the full victim count was reported to HHS in August and could still change. 2

• Information taken: The stolen material included names, postal addresses, Social Security numbers, medical and health information, government ID data—including passport and driver’s-license numbers—and, for some people, banking and other financial information. 2

• Company role: CareCloud is a New Jersey-based healthcare-technology provider that stores electronic medical records and handles billing/practice data for hospitals, physicians’ offices, and other healthcare practices—giving it access to data on millions of patients. 2

• Federal reporting: The company filed the breach with the HHS Office for Civil Rights, whose public portal lists large breaches that are under investigation. 1 The August filing established the 3.75-million-plus scale reported publicly. 2

• What remains unknown: CareCloud has not publicly provided a fuller account since its March disclosure. Its CEO, Stephen Snyder, reportedly did not answer questions about whether ransom was paid, who held cybersecurity responsibility, or whether he would resign. There is therefore no confirmed public evidence of a ransom payment, attribution to a particular hacking group, management culpability, or planned CEO departure. 2

• Relative scale: CareCloud ranks fifth among reported healthcare-data thefts in 2026 at the time of disclosure. It is larger than TriZetto Provider Solutions’ reported 3,433,965-person incident, while DentaQuest’s HHS filing lists 15 million affected people. 13 Craneware was also among the year’s prominent healthcare-sector incidents, but the available reporting did not establish a directly comparable final affected-person count; it should not be ranked against CareCloud without that figure. 3