GoKawiilU.S. healthcare IT company CareCloud disclosed that the data breach incident it suffered earlier this year has impacted more than 3.7 million individuals.
The healthcare technology organization is publicly traded and provides electronic health records, medical billing, practice management, and revenue-cycle services.
The company disclosed the incident in March via a filing with the U.S. Securities and Exchange Commission (SEC), noting that the attack caused an 8-hour network disruption on its platform and cut access to one of its databases.
At the time, the firm said the compromised environment contained patient data, indicating the risk of sensitive medical information being stolen.
Following the incident, CareCloud launched an investigation to determine its scope and how many people were potentially impacted.
In a report to the U.S. Department of Health and Human Services, the company informs that the number of people affected by the breach was 3,756,469.
CareCloud started to distribute data breach notifications on July 25, sharing more details uncovered during the investigation.
“The investigation determined that, between March 10 and March 16, 2026, an unauthorized third party accessed one of CareCloud’s AWS environments and claimed to have exfiltrated data from databases within that environment,” the notification says.
Beyond full names, the sample letter shared with authorities does not specify the type of data exposed.
The notification recipients are offered 12/24 months of identity protection service coverage through IDX, redeemable until December 17, 2026.
... continue reading