CareCloud, Inc.
CareCloud electronic health record cyber incident
Summary
CareCloud said an intruder accessed one of its six electronic health record environments from March 10 to March 16, 2026, disrupting functionality and data access for about eight hours before restoration. Forensic analysis confirmed data exfiltration, and breach filings showed at least 345,000 people across the United States were affected by theft of medical, identity and financial information. No stable public ransomware or extortion claim identifies a responsible actor.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Operational impacts
-
Degraded service
Services remained available but with reduced performance, reliability, functionality, capacity, or responsiveness.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
Incident narrative
Analyst assessment
CareCloud experienced a confirmed cyber intrusion affecting one CareCloud Health electronic health record environment. The company’s March 27 SEC filing said an unauthorized third party partially disrupted functionality and data access for about eight hours March 16, 2026. A May 7 Form 10-Q said forensic analysis found that an undetermined amount of data was exfiltrated and that initial access occurred about one week before March 16.
Operational significance
The disruption was limited to one of CareCloud’s six EHR environments. The company restored all affected functionality and data access March 16 and said its other platforms, divisions and environments were unaffected. The public record does not identify particular hospitals, practices or patient-care episodes disrupted during the eight-hour outage.
The confidentiality impact was broader. California and Texas breach records identified medical, identity and financial information in the notification process. TechCrunch reported that state filings showed at least 345,000 affected people across the United States.
Disclosure posture
CareCloud first publicly disclosed the incident in its March 27 SEC filing after determining March 24 that the event was material. The filing confirmed unauthorized access and disruption but said data access or exfiltration remained under review. The May 7 filing converted that uncertainty into a forensic finding of exfiltration.
Current status
The incident is resolved. CareCloud said the event was contained March 16, all affected systems were restored and the intruder no longer had access. Later notifications document the continuing breach-response process, not renewed operational disruption.
Confidence and uncertainty
Confidence is high that unauthorized access, an eight-hour disruption and data exfiltration occurred because CareCloud described each in SEC filings. Ransomware and attribution remain unresolved. Searches using CareCloud’s name and carecloud.com did not identify a stable victim claim, and no public source describes encryption, a ransom demand or a leak-site post.
Analytic gaps
Public sources do not establish the initial access vector, compromised identity, exploited vulnerability, malware family, exact database scope, complete affected-person count, whether stolen information was published or every affected provider and patient location.
Organizations involved
Impacted location
Sources
CareCloud said an unauthorized third party disrupted one of six electronic health record environments for about eight hours on March 16, restoring access that evening while investigators assessed possible patient data exposure.
CareCloud reported that an unauthorized third party temporarily accessed one CareCloud Health EHR environment, causing about eight hours of partial functionality and data-access disruption before full restoration on March 16.
CareCloud said forensic analysis found that an undetermined amount of data was exfiltrated, that unauthorized access began about one week before March 16 and that all affected systems were fully restored.
The California attorney general record publishes CareCloud’s breach-notification sample and identifies March 10, 2026, as the start of the known breach period.
The Texas filing reported 270,197 affected Texas residents and listed names, addresses, Social Security and government identification numbers, financial information, medical information, health insurance information and dates of birth among the involved data types.
TechCrunch reported that breach filings in several states showed at least 345,000 affected people and that compromised information included medical, identity and financial data. It said no known ransomware group had publicly claimed the incident.
The organization’s official website describes its identity, services, operating role and public or customer-facing programs.
The Census Bureau Gazetteer Files provide authoritative geographic reference data for states, counties, county equivalents and places in the United States.
See something that needs correction?
Signed-in members can report an error, update, or missing source.