Health data giant CareCloud has confirmed to federal regulators that hackers stole the personal information and medical records of more than 3.75 million people. This disclosure marks the first confirmation of the scale of the data breach, which is now the fifth-largest theft of health data in 2026 to date.
CareCloud detailed the March data breach in a filing with the Department of Health and Human Services (HHS) on Monday. The number of affected victims was reportedly revised upwards in an update on Tuesday.
The stolen data includes patients' names, postal addresses, Social Security numbers, medical and health information, government-issued identification numbers such as passports and driver's licenses, and banking and financial information.
CareCloud had previously stated in March that hackers accessed patient medical data stored in one of its cloud storage environments over six days. The company later confirmed that data was exfiltrated from its Amazon Web Services account.