Six days. That’s roughly how long hackers sat inside CareCloud‘s cloud storage before anyone noticed, and by the time the company finished counting the damage, more than 3.75 million people’s medical records were gone.
CareCloud confirmed the scale of the breach in a filing with the Department of Health and Human Services on Monday, and the New Jersey based company revised the number upward again the very next day. It’s not clear yet whether that figure will keep climbing. The breach now ranks as the fifth largest theft of health data reported in the US so far in 2026.
CareCloud isn’t a hospital or a clinic. It’s the infrastructure underneath thousands of them, providing electronic medical record storage to tens of thousands of healthcare providers across the country. That’s what makes a breach here so damaging. One compromised system can expose patient data from countless doctor’s offices and hospitals at once.
The company first disclosed the incident in March, saying hackers had accessed patient data stored in one of its cloud environments over a six day stretch. In later breach notifications, CareCloud said the attackers pulled the data directly out of its Amazon Web Services account.
What they took goes well beyond names and addresses. The stolen records include Social Security numbers, medical and health information, government issued IDs like passports and driver’s licenses, and banking and financial details, essentially everything needed to commit identity theft or insurance fraud against millions of people at once.
CareCloud CEO Stephen Snyder has not responded to multiple requests for comment on the incident, including questions about whether the company paid a ransom, who oversees cybersecurity at the company, or whether he plans to step down.
This breach adds to a string of major healthcare data incidents already reported this year. TriZetto confirmed in March that a 2024 breach affected 3.4 million people, and billing software maker Craneware disclosed its own breach in July with the number of victims still unclear. DentaQuest still holds the largest breach of 2026 so far, affecting at least 15 million people, according to HHS’s running tally.
