Data breach exposes health records of 3.8M patients
What's the story
CareCloud, a leading health data company, has confirmed with federal regulators that the personal information and medical records of over 3.75 million people were stolen in a recent data breach. The incident is now officially recognized as the fifth-largest theft of health data this year. The New Jersey-based tech firm provides electronic medical record storage services to tens of thousands of healthcare providers across the US, consequently serving millions of patients.
Company statement
CareCloud hack dates back to March
In March, CareCloud revealed that hackers had accessed patients' medical data from one of its cloud storage environments over a period of six days.
The company later confirmed in data breach notifications that the attackers exfiltrated data from its Amazon Web Services (AWS) account and stole large amounts of patient information.
However, since then, CareCloud has remained silent on the matter.
Data theft
Stolen data includes names, addresses, and Social Security numbers
The stolen data in the CareCloud breach includes patients' names, addresses, Social Security numbers, and medical and health information.
The hackers also stole government-issued identification numbers such as passports and driver's licenses, as well as banking and financial details.
This incident has raised serious concerns about the security of sensitive health data stored by tech companies for healthcare providers.
Leadership silence
CEO Stephen Snyder has not commented on the matter
Despite multiple requests for information about the incident, including whether the company has paid off hackers or who is responsible for cybersecurity at CareCloud, CEO Stephen Snyder has not commented.
The lack of transparency from the company's leadership has only added to concerns over this major data breach impacting millions of patients.
Industry impact
Other major healthcare data breaches this year
The breach at CareCloud comes on the heels of other major healthcare data breaches this year.
In March, tech giant TriZetto confirmed a 2024 data breach affecting 3.4 million people.
Additionally, an unspecified number of people had their data stolen in July from healthtech billing software maker Craneware.
These incidents highlight the growing threat to sensitive health information stored by tech companies for healthcare providers.