CareCloud confirms 3.7M patients had their medical records stolen in data breach

Healthcare technology company CareCloud has confirmed that a cyberattack exposed the sensitive medical records of approximately 3.7 million patients, making it one of the most significant healthcare data breaches reported in the United States so far this year, raising fresh concerns about digital security in the medical sector.

CareCloud, a healthcare IT and revenue cycle management company serving medical practices across the U.S., has disclosed that a cyberattack compromised the personal and medical records of roughly 3.7 million patients. The breach ranks among the largest in the American healthcare industry reported this year.

The incident underscores an ongoing and intensifying wave of cyberattacks targeting healthcare organizations, which hold extraordinarily sensitive data including diagnoses, treatment histories, and insurance information. Unlike financial data, medical records cannot simply be cancelled or reissued, making their exposure particularly harmful and long-lasting for affected individuals.

CareCloud has not yet publicly detailed the specific type of attack or the full timeline of events, but the scale of the breach will likely draw scrutiny from federal regulators, including those enforcing HIPAA compliance standards.

CareCloud, a Florida-based company that provides cloud-based practice management, electronic health records, and billing services to thousands of medical professionals nationwide, has officially confirmed that cybercriminals stole the protected health information of approximately 3.7 million patients. The incident places it firmly among the most serious healthcare data breaches disclosed in the United States this calendar year.

The stolen data reportedly includes highly sensitive patient information — the kind typically found in medical and administrative records, such as names, dates of birth, Social Security numbers, diagnoses, treatment details, and insurance information. This combination of personal and medical data is particularly valuable on criminal marketplaces and can be exploited for identity theft, insurance fraud, or targeted phishing schemes against vulnerable individuals.

CareCloud's role as an intermediary technology provider amplifies the breach's reach. Because the company serves as a back-end infrastructure partner for numerous independent medical practices and clinics, patients whose primary providers used CareCloud's systems may not have been directly aware of the company's involvement in storing their information — making notification and remediation efforts more complex.

Why it matters: Healthcare remains one of the most frequently targeted sectors for cybercriminals, and breaches of this magnitude have real human consequences. Medical records, unlike credit card numbers, carry a permanent trail of sensitive personal history that cannot be reset. Victims face years of potential exposure, and for patients with stigmatized conditions, the psychological harm can be severe. This incident also signals that mid-tier healthcare IT vendors — not just large hospital networks — present significant systemic vulnerabilities.

Regulators are likely to take notice. The U.S. Department of Health and Human Services enforces strict breach notification and data protection rules under HIPAA, and breaches affecting more than 500 individuals trigger mandatory public reporting. With 3.7 million affected patients, CareCloud will face considerable regulatory scrutiny, and the breach may fuel broader legislative conversations about strengthening cybersecurity mandates across the entire healthcare technology supply chain.