CareCloud begins breach notifications after theft of medical records

CareCloud has begun notifying patients that hackers stole records from an electronic health record store hosted on Amazon Web Services. At least 345,000 people are affected so far. The attackers had access for six days, from March 10 through March 16, before the company disclosed the incident to regulators on March 27.

Why the breach has broad consequences

The New Jersey health technology company stores patient records for more than 45,000 U.S. providers, including hospitals, physicians’ offices and other medical practices. Its systems therefore hold data that can support identity theft, financial fraud and highly targeted social engineering.

The compromised material includes names, postal addresses, Social Security numbers, passport and driver’s license details, bank account information and payment card numbers. Medical and other health-related information was also exposed, making replacement or remediation far more difficult than for a compromised password.

What the disclosures reveal

The attackers entered one of CareCloud’s six patient data stores. In its California filing, the company said a hacker made the following assertion:

“Claimed to have exfiltrated data from databases.”

No ransomware or extortion group has publicly claimed responsibility. CareCloud has not explained how the attackers gained access, while chief executive Stephen Snyder did not respond to questions about the incident.

State filings in New Hampshire, Massachusetts, Texas and Maine indicate that at least 345,000 people are affected, and the total may increase as further notices appear. The incident follows the NYC Health + Hospitals breach affecting 1.8 million people and a TriZetto breach that affected 3.4 million people, underscoring the concentration of risk in healthcare technology suppliers.

What businesses should do now

Healthcare organizations should treat hosted record systems as part of their own risk perimeter. In practice, that means inventorying every sensitive repository, minimizing privileged access, monitoring bulk extraction, validating suppliers’ incident-response obligations and rehearsing notifications before a breach forces those processes into production.