CareCloud Alerts Hundreds of Thousands Following Breach of Medical Records by Hackers
Numerous individuals are receiving notifications regarding the theft of their medical records due to a cyberattack on CareCloud, a prominent health technology company in the U.S., which occurred earlier this year.
Since March, the company has remained largely silent about the incident, having initially disclosed that one of its patient data stores was compromised. Recent reports provide a clearer understanding of the breach, revealing that approximately 350,000 individuals have been impacted.
CareCloud, headquartered in New Jersey, manages patient information for over 45,000 healthcare providers nationwide, encompassing various medical facilities such as doctors’ offices and hospitals. Consequently, the company handles sensitive medical and billing information for millions of patients across the country.
In a data breach notification filed to the attorney general’s office in California this week, CareCloud disclosed that hackers accessed one of its electronic health record databases for a minimum of six days, from March 10 to March 16. The company noted that the hackers claimed to have extracted data from these databases. However, details on how the hackers made this assertion were not provided; it is common for cybercriminals to offer samples of stolen data along with ransom demands to deter public exposure.
Thus far, no ransomware or extortion group has publicly claimed responsibility for the breach involving CareCloud.
The notice provided minimal detail beyond the initial disclosure made to regulators in late March but confirmed earlier reports that the breach occurred within the company’s Amazon Web Services-hosted data storage.
Reports indicate that at least 345,000 individuals have been affected, according to filings from several state attorneys general, including those in New Hampshire, Massachusetts, and Texas. Additional documentation from Maine’s attorney general has also been reviewed by sources.
As further disclosures are made to state authorities, the number of impacted individuals is expected to increase.
The notifications indicate that the compromised data includes individuals’ names, addresses, Social Security numbers, and government-issued identification numbers, like passports and driver’s licenses. Additionally, the stolen information comprises financial details, such as bank account numbers and credit card information, in conjunction with extensive medical records.
CareCloud’s CEO, Stephen Snyder, has not responded to inquiries regarding the incident or the company’s security protocols.
The cyberattack on CareCloud is part of a troubling pattern of breaches affecting healthcare providers this year. Other incidents include a breach at TriZetto, which compromised the data of 3.4 million people, and a prolonged breach at NYC Health + Hospitals, where hackers accessed health information for 1.8 million individuals and sensitive employee biometric data.
Recently, Craneware, a technology provider based in the U.K. that supplies billing and accounting software to numerous American healthcare institutions, confirmed that a substantial amount of customer data had been stolen, raising further alarms about patient information safety.
If you have additional information regarding CareCloud’s data breach or insights into its security measures, please reach out with secure communications.
