Notice of Data Security Incident
Last updated: 07/01/2026 • This information reflects our investigation to date and is subject to update.
CareCloud, Inc. is providing this notice to share important information about a recent data security incident. The privacy and security of the personal information CareCloud maintains is of the utmost importance to the company. This page explains what happened, the information that may have been affected, the steps CareCloud has taken, and the steps individuals can take to protect themselves.
What Happened?
On March 16, 2026, CareCloud experienced a network disruption in its CareCloud Health division that impacted one of its electronic health record environments. Upon discovering this incident, CareCloud promptly opened an investigation and engaged a leading cyber response advisory team experienced in handling these types of incidents, to assist with securing the environment, and conduct a comprehensive forensic investigation to determine the nature and scope of the incident. CareCloud also reported the matter to the appropriate law enforcement authorities.
The investigation determined that, between March 10 and March 16, 2026, an unauthorized third party accessed one of CareCloud’s AWS environments and claimed to have exfiltrated data from databases within that environment. There is no evidence of unauthorized activity within CareCloud’s environment since March 16, 2026.
What Information Was Involved?
CareCloud has worked diligently to assess the data and identify the affected protected health information. On June 24, 2026, CareCloud determined that the affected data may have included an affected individual’s full name and one (1) or more of the following: address, date of birth, Social Security number, driver’s license number, health insurance member number, health insurer name, policy and group numbers, primary care and referring physician information, medications, allergies, and other demographic and health insurance information. For a very limited subset of individuals, full credit card information including CVV was also affected. The affected data varied by individual.
What CareCloud Is Doing
Upon discovering the incident, CareCloud quickly launched an investigation and took steps to contain and remediate the issue. CareCloud engaged external cybersecurity experts and, with their assistance, secured the affected environment, eliminated the threat, and confirmed that no persistent unauthorized access remained. CareCloud is continuing to strengthen the security of its systems and environments.
What Affected Individuals Can Do
To date, CareCloud is not aware of any reports of identity fraud or improper use of information as a direct result of this incident. Out of an abundance of caution, CareCloud encourages affected individuals to take steps to protect themselves and to remain vigilant by reviewing their financial account statements and credit reports for fraudulent or irregular activity on a regular basis.
The steps below describe precautionary measures available at no cost, including placing a fraud alert and/or security freeze on credit files and obtaining a free credit report.
Steps Individuals Can Take to Protect Themselves
Individuals may take any of the following precautions at no cost:
Place a fraud alert. A one-year fraud alert tells creditors to contact the individual before opening new accounts. An individual may contact any one of the three credit bureaus, which will notify the other two.
800-525-6285
888-397-3742
800-680-7289
Place a security freeze. A freeze restricts access to an individual’s credit report. To place one, an individual must contact each of the three bureaus (Equifax 888-298-0045; Experian 888-397-3742; TransUnion 888-909-8872). There is no fee.
Obtain free credit reports. Individuals are entitled to a free report from each bureau every 12 months at annualcreditreport.com or 1-877-322-8228, and should review them for accounts or activity they do not recognize.
Use additional resources. Individuals can learn more about protecting themselves from identity theft, and report suspected misuse, to the Federal Trade Commission at ftc.gov/idtheft, 1-877-IDTHEFT (1-877-438-4338), or Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580.
For More Information
CareCloud regrets that this incident occurred. CareCloud is committed to maintaining the privacy of the personal information in its possession and has taken many precautions to safeguard it, and it continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information.
Individuals with questions about this incident may call CareCloud’s dedicated, confidential toll-free response line at 800-411-9670, available Monday through Friday, 9:00 a.m. – 5:00 p.m. ET. The response line is staffed with professionals familiar with this incident and the steps individuals can take to protect against misuse of their information.