CareCloud breach: 3.7 million records exposed in hacking incident
CareCloud, Inc., a business associate based in New Jersey, reported a hacking/IT incident to HHS OCR on July 24, 2026. The breach affected 3,756,469 individuals, with data compromised on a network server. Because CareCloud is a business associate, any healthcare providers, health plans, or other covered entities that use its services may need to verify if their patient data was included in this incident. Organizations should review their contracts and communications from CareCloud to determine exposure. This filing date is when the report was submitted to the regulator, not necessarily when the breach occurred or was discovered.
Sources differ:
- The HHS OCR breach portal record lists a submission date of 07/24/2026; a secondary news summary describes an HHS filing dated August 17, 2026.
- The HHS record lists the breach location as a network server; news reports describe an intrusion into a cloud (AWS) environment in March 2026 and earlier state filings of about 350,000 individuals.
Primary source: HHS OCR Breach Portal — CareCloud, Inc. (NJ) · reported 07/24/2026 · 3,756,469 individuals · Checked against the record 2026-10-15