type: incident · created: 2026-08-20 · updated: 2026-08-20 · tags: [incident, breach, healthcare, ehr, carecloud] · confidence: high · affected_sectors: [healthcare] · au_impact: false
CareCloud Says 3.7M People Affected by March EHR Breach
CareCloud disclosed to the Department of Health and Human Services that 3,756,469 people were impacted after a hacker held access to one of the company's AWS-hosted electronic health record (EHR) environments for eight hours from 10–16 March and exfiltrated data.
| Attribute | Detail |
|---|---|
| Scope | 3,756,469 people affected |
| Vector | Access to AWS-hosted EHR environment (10–16 March, ~8h) |
| Data | Personal details, SSNs, ID numbers, credit/debit card info, medical and insurance data |
| Response | Reported to law enforcement; SEC notified in late March |
| Source | HIPAA Journal — Tier 2/4 |
One of the larger US EHR breaches of 2026, with a broad PHI/financial data exposure.