Loading story…
CareCloud disclosed that hackers breached an AWS environment tied to its CareCloud Health electronic health record platform and accessed a data store between March 10 and March 16, disrupting the environment before the company secured it. Breach notices filed with state attorneys general and subsequent reporting indicate the attackers claimed to have exfiltrated database data, with the incident affecting roughly 345,000 to 350,000 people in the United States.
The compromised information included names, addresses, dates of birth, Social Security numbers, driver’s license and other government ID numbers, bank account and payment card details, and medical and health insurance records. CareCloud said it engaged external cybersecurity experts, removed the threat, found no evidence of persistent unauthorized access, and is offering up to 24 months of identity theft protection and credit monitoring, while no ransomware or extortion group had publicly claimed responsibility at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On June 24, 2026, CareCloud determined that personal, financial, and medical information had been compromised in the incident. The exposed data included identifiers such as Social Security numbers, dates of birth, government ID numbers, payment card and bank account information, and health-related records.
CareCloud previously disclosed the incident on March 27, 2026. Early reporting indicated the compromised data storage was hosted on Amazon Web Services.
On March 16, 2026, the affected CareCloud environment was disrupted, marking the end of the known intrusion period. CareCloud later said it secured the environment, removed the threat, and found no persistent unauthorized access.
Hackers accessed an AWS environment tied to CareCloud Health's electronic health record data store between March 10 and March 16, 2026, and claimed to have exfiltrated data from databases. The compromised information included personal, financial, and medical data.
CareCloud filed breach notices with multiple state attorneys general disclosing that at least 345,000 to 350,000 people in the United States were affected. The notices said affected individuals would be offered up to 24 months of identity theft protection and credit monitoring.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourcesecurityweek.com
Open sourceteiss.co.uk
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CareCloud, Inc. disclosed in a Form 8-K that an unauthorized third party temporarily accessed part of its network within the CareCloud Health division, causing a disruption on March 16 that partially affected functionality and data access in one of the company's six electronic health record environments for about eight hours. The company said it contained the incident the same day, restored affected systems, and reported that no ongoing threat actor access remains. CareCloud said it engaged external cybersecurity and forensic specialists and notified law enforcement and its cyber insurance carrier while investigating whether patient information or other data was accessed or exfiltrated. Although the company said operations had not been materially affected as of the filing date, it determined the incident was material because of the sensitivity of the potentially affected information and the possible legal, regulatory, remediation, reputational, and operational consequences.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Cognizant Technology Solutions, through its subsidiary TriZetto Provider Solutions, experienced a significant data breach that went undetected for nearly a year, exposing sensitive personal information such as Social Security numbers, financial account details, and home addresses. The breach, which affected at least 100 individuals across several states, led to multiple class-action lawsuits alleging delayed disclosure, insufficient notification to victims, and a lack of transparency regarding the incident's root cause and remediation. Plaintiffs argue that the delay in notification left affected individuals vulnerable to identity theft and financial fraud, while Cognizant and TriZetto have offered limited public comment due to ongoing litigation. Separately, Covenant Health, a major healthcare provider operating in several northeastern US states, suffered a ransomware attack by the Qilin group in May 2025. The attack compromised the data of over 478,000 individuals, leading to system shutdowns across hospitals and clinics and prompting the organization to hire cybersecurity experts for containment and investigation. Covenant Health initially reported a smaller number of affected individuals but later updated the total to nearly half a million, subsequently notifying patients and offering credit monitoring and identity protection services. Both incidents underscore the persistent cybersecurity risks facing the healthcare sector and the significant impact of breaches on patient privacy and organizational trust.
Jun 29, 2026