CareCloud AWS Breach Exposes 3.7 Million Records Including SSNs and Medical Data Over Six-Day Window

CareCloud filed with HHS confirming the March incident after an unauthorized actor remained inside its AWS environment for 144 hours. Stolen fields included Social Security numbers, insurance details, credit card data, and clinical records. The company serves more than 45,000 providers and reported $120.5 million revenue last year. Initial law enforcement contact shifted to SEC disclosure by March 24 once the scale of sensitive data became clear. Texas alone accounts for over 270,000 affected residents; smaller tallies appear in South Carolina and Oregon. No ransomware group claimed the operation, consistent with prior unreported healthcare exfiltrations focused on data resale rather than encryption. The six-day dwell time matches patterns seen in other cloud-hosted EHR environments where monitoring gaps allow prolonged access. Healthcare cloud infrastructure has drawn repeated targeting, with at least three major EHR vendors reporting similar incidents in the past 18 months. CareCloud’s decision to limit public detail to breach notification letters leaves open questions about logging, segmentation, and detection latency. State attorneys general and HHS OCR now hold the filings; enforcement timelines typically begin once aggregate impact is confirmed. Daily implications include heightened identity theft risk for patients whose SSNs and medical histories are now circulating, plus downstream effects on insurance and credit systems that rely on unaltered health records.