CareCloud Confirms 350,000+ Affected in AWS Environment Breach

CareCloud has confirmed that intruders stole the personal, financial, and medical information of at least 350,000 people from one of its Amazon Web Services (AWS) environments, according to a breach notification the healthcare-technology company filed with the Massachusetts Office of Consumer Affairs and Business Regulation and reported by SecurityWeek. The company's investigation determined that attackers accessed the environment between March 10 and March 16, 2026, and likely exfiltrated data before the access was cut off.

This sharpens what was still unsettled when The CyberSignal covered the notification stage last week, when CareCloud had begun mailing letters but the specific data classes and a firm headcount had not been established. Two things are now on the record: the categories of data taken — personal, financial, and medical — and a floor of at least 350,000 affected individuals, drawn from filings with attorneys general in several states. This is the same incident CareCloud first disclosed to the SEC as material back in the spring; what changed is the scope, not the underlying breach.

What CareCloud Now Confirms

The incident involved an electronic health record environment within the CareCloud Health division, which was disrupted on March 16, 2026. On June 24, the company's investigation concluded that personal, financial, and medical information had been compromised. According to the notification letter, the potentially affected data includes names, addresses, Social Security numbers, dates of birth, driver's license numbers, government identification numbers, financial account numbers, credit and debit card numbers, and medical and health-insurance information.

That is a broad and unusually damaging combination. It pairs the identity building blocks used for financial fraud — Social Security numbers, government IDs, and payment card data — with health and insurance records that drive a separate category of medical identity theft. CareCloud says it engaged external cybersecurity experts, secured the affected environment, eliminated the threat, and confirmed that no persistent unauthorized access remained.

The timeline that has now come together:

• March 10–16, 2026 — Attackers access one of CareCloud's AWS environments and likely exfiltrate data.
• March 16, 2026 — The affected electronic health record environment is disrupted; CareCloud restores it.
• June 24, 2026 — The investigation determines that personal, financial, and medical information was compromised.
• July 2026 — State filings put the confirmed count at at least 350,000 people; individual notifications go out.

What Affected Individuals Should Do Now

Because Social Security numbers, driver's license and government ID numbers, and financial account and card numbers were involved, anyone who receives a letter should treat it as genuine rather than a phishing lure and act on the services offered. CareCloud is providing up to 24 months of free identity-theft protection, credit monitoring, and ID-theft recovery, bundled with a $1,000,000 insurance reimbursement policy — enrolling costs the recipient nothing and is the first practical step.

Beyond that, place a credit freeze with the three major bureaus, or at minimum a fraud alert; a freeze restricts new-credit activity in your name and is the stronger control. Watch bank and card statements for transactions you do not recognize. And because medical and health-insurance data was taken, monitor Explanation of Benefits statements for procedures, providers, or claims you never received — that is the specific signature of medical identity theft and insurance fraud, and it surfaces in benefits statements rather than on a credit report. Misuse can be reported to the U.S. Federal Trade Commission at IdentityTheft.gov. Unlike a password, a Social Security number or a medical history cannot be reset, so the vigilance has to be sustained.

The Cloud-Configuration Lesson for Peers

The analysis that follows is The CyberSignal's editorial assessment, not new reported fact. For defenders at other healthcare-technology firms, the durable lesson is not that AWS failed — the notice does not establish that, and the access vector is unknown — but that a single cloud environment holding an entire electronic health record dataset is a concentration point by design. The value sits where the records sit, and that is exactly where an intrusion pays off.

The practical work is the unglamorous kind: segmenting record stores so one compromised environment does not expose the whole population, enforcing least-privilege IAM so stolen access reaches less, tightening data retention so there is less to take, and — critically — instrumenting exfiltration detection so a multi-day window like March 10–16 gets caught in hours rather than reconstructed months later. This is the same concentration dynamic behind 2026's largest healthcare breaches, including DentaQuest's disclosure affecting more than 23 million people; the scale of the fallout tracks the scale of the data pooled in one place, not the sophistication of any single technique.

Open Questions

Several specifics remain unresolved, and The CyberSignal is not filling them in. The notice describes an "AWS environment" without naming the class of service that held the data, so the exact storage or database exposed is not established. The access vector — how the intruders got in — has not been disclosed. CareCloud has not named a threat actor, and no group has publicly claimed the theft in the reporting reviewed here. And the 350,000 figure is explicitly a floor: it is drawn from state attorney-general filings, CareCloud has not shared a final total, and how the incident appears on the U.S. Department of Health and Human Services Office for Civil Rights breach portal — typically the most authoritative public count for a breach of protected health information — is not yet established. The defensive steps above hold regardless of how those questions resolve.

Primary Documents

• CareCloud breach notification letter, filed with the Massachusetts Office of Consumer Affairs and Business Regulation.
• SecurityWeek — CareCloud Data Breach Impacts Over 350,000.