Healthcare data breach exposes 3.75M patient records

You can be careful with your passwords and still get caught in a breach at a company you may have never heard of. That is one of the frustrating parts of the CareCloud data breach. More than 3.75 million people had personal information and medical records stolen after hackers gained access to a CareCloud cloud environment earlier this year.

CareCloud provides electronic medical record technology and other services to tens of thousands of healthcare providers across the U.S. So, even if you never created a CareCloud account, a doctor's office or another healthcare provider could have used its technology to handle your information. Now, we are getting a much clearer picture of just how much information hackers took.

Missed CyberGuy LIVE? Watch the Protect Your Money replay

Our free CyberGuy LIVE class, Protect Your Money From Today’s Biggest Threats , has ended, but you can still watch the full replay and download our financial protection checklist. Kurt "CyberGuy" Knutsson walks you through five simple ways to help defend yourself against AI scams, fraud, identity theft and financial hacks. You’ll learn how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed.

Get the free replay and checklist now at CyberGuyLive.com

INSURANCE BREACH EXPOSES 7M DRIVER'S LICENSES

The cyberattack dates back to March 2026. According to a breach notice filed with the California Attorney General, CareCloud experienced a network disruption on March 16. The company brought in outside cybersecurity experts to investigate. CareCloud later determined that an unauthorized third party had access to one of its Amazon Web Services environments between March 10 and March 16, 2026.

The company said the attacker claimed to have taken data from databases inside that environment. CareCloud also said it found no evidence of continued unauthorized activity after March 16. Early disclosures showed hundreds of thousands of people were affected. However, that figure later climbed dramatically. CareCloud has now reported that more than 3.75 million people were affected, according to federal health regulators. The disclosure places the incident among the largest healthcare data breaches reported so far in 2026.

Here is where this breach becomes especially concerning. The stolen information goes well beyond an email address or phone number. What was exposed varies from person to person, but the data may include:

Think about how much a criminal can learn from that combination. A Social Security number can help fuel identity theft. Banking information could put financial accounts at risk. Medical records can also give criminals deeply personal details that make phishing emails and scam calls far more convincing. Then there is another threat many people rarely think about: medical identity theft.

MEDICAL IDENTITY THEFT FOLLOWS YOU INTO THE DOCTOR'S OFFICE

You can change a password after a breach. Your medical history is much harder to replace. A criminal could use stolen insurance or personal information to seek medical care under someone else's identity. Fraudulent claims can also appear under a victim's health insurance.

In some cases, incorrect treatment or medical information could eventually make its way into someone's records. That creates problems that can extend beyond financial fraud. The Federal Trade Commission advises people who suspect medical identity theft to review their medical records and insurance statements. Look closely for unfamiliar treatments, providers, prescriptions or charges. We recently covered this growing problem in Medical identity theft follows you into the doctor's office.

CareCloud says it brought in outside cybersecurity specialists after discovering the incident. The company also reported the attack to law enforcement and secured the affected environment. According to its breach notice, investigators found no continued unauthorized access after the incident was contained.

CareCloud has also offered affected individuals complimentary identity protection services through IDX. If you received a notification letter, check it carefully for enrollment instructions and the amount of time you have to sign up.

CyberGuy reached out to CareCloud for comment, but we did not hear back before our deadline.

A breach involving Social Security numbers, medical records and financial information deserves your attention even if you have not noticed anything suspicious yet. Here are the steps I recommend taking.

Start with the letter or notification you received. Look for the specific types of information CareCloud says were involved in your case. Not every affected person necessarily had the same information exposed. If you were offered free identity protection or credit monitoring, review the terms and enrollment deadline. Consider signing up while the service remains available.

If your Social Security number was exposed, consider freezing your credit with Equifax, Experian and TransUnion. A credit freeze limits access to your credit file. That can stop many criminals from opening new credit accounts in your name. Federal law allows you to freeze and unfreeze your credit for free. However, a credit freeze cannot block every form of identity theft. Someone could still attempt to take over an existing account or misuse your personal information in other ways. For a deeper look at those limitations, read Why a credit freeze isn't the end of identity theft.

Keep an eye on your bank accounts, credit cards and credit reports. Look for purchases you do not recognize, unfamiliar credit inquiries or accounts you never opened. If something looks suspicious, contact the bank or financial institution directly. Use the phone number printed on your card or listed on the company's official website. Be wary of anyone who unexpectedly contacts you and claims they need personal information to investigate the CareCloud breach.

Do not limit your monitoring to your credit report. Sign in to your healthcare portals and review your records. Also look carefully at the explanation of benefits statements from your health insurer. Watch for unfamiliar doctors, procedures you never received or claims that make no sense. If something looks wrong, contact both your healthcare provider and insurer. Medical identity fraud may never trigger a traditional credit alert, which makes checking these records particularly important.

Use strong and unique passwords for important accounts, especially email, banking and healthcare services. If you reuse the same password on multiple sites, change it. A password manager can generate and securely store complex passwords so you do not have to remember them all. Turn on two-factor authentication (2FA) whenever it is available. That extra verification step can make it harder for someone to get into an account even if they obtain your password. Pay extra attention to your primary email account. Criminals can use access to your inbox to reset passwords for other services.

A stolen medical record could give a scammer enough personal information to send you a very convincing message. You might receive an email that appears to come from a doctor, health insurer or breach-response company. The message could include a malicious attachment or direct you to a fake login page. Strong antivirus software can help detect malicious links, dangerous downloads and other threats that arrive through phishing emails or scam messages. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, helping keep your personal information and digital assets safer. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

This breach creates another problem. Scammers may now have enough real information about victims to sound believable. Be skeptical if someone suddenly contacts you claiming to represent CareCloud, your doctor, your insurance company or a credit-monitoring service. A criminal might know your name, address or other personal details. That knowledge does not make the person contacting you legitimate. Avoid clicking links in unexpected messages. Instead, open the organization's official website yourself or call a number you already trust. Also be suspicious of anyone demanding immediate payment or asking you to provide a verification code.

The information stolen from CareCloud can become even more useful to criminals when they combine it with data that already appears online. People-search websites and data brokers can contain your phone number, current or previous addresses and other identifying information. Scammers can combine those details with breached data to build a more complete profile of you. A personal data removal service can help reduce your online footprint by sending removal requests to data brokers on your behalf. Some services also continue checking to see whether your information reappears. No service can guarantee that every piece of personal information will disappear from the internet. Still, removing information from data broker databases can make it harder for scammers to gather additional details about you. You can make removal requests yourself as well. However, doing it manually can be time-consuming and may require repeated requests. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

If you discover that someone is using your information, act quickly. Visit the Federal Trade Commission's IdentityTheft.gov website to report identity theft and create a personalized recovery plan. Keep records of suspicious transactions, emails and letters related to the fraud. Save copies of any reports you file as well. The sooner you spot suspicious activity, the sooner you can start limiting the damage.

What bothers me most about the CareCloud breach is how little control you may have over where your medical information ends up. You can choose a doctor you trust. You can create strong passwords and protect your own devices. Yet some of your most sensitive information may still pass through another company's systems behind the scenes. That leaves millions of people dealing with the consequences when something goes wrong. If your information was involved, I would take the notification seriously even if everything looks normal today. A stolen Social Security number or medical record can remain useful to criminals long after the original breach fades from the news. Freeze your credit if your Social Security number was exposed. Watch your medical records and financial accounts over time. Then be especially cautious when an unexpected email, call or text seems to know surprisingly personal details about you. I would also reduce what data brokers can easily find about you and keep strong antivirus protection running on your devices. Those added layers can make follow-up attacks harder for scammers to pull off.

How would you feel if you discovered a company you had never heard of was storing some of your most sensitive medical information? Should healthcare providers be required to tell you which outside companies have access to your records? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.