CareCloud begins notifying hundreds of thousands after hackers stole medical records
US health tech company CareCloud has started notifying nearly 350,000 people that hackers stole their medical records and personal data during a cyberattack in March that lasted at least six days.
US health tech giant CareCloud has begun sending notification letters to nearly 350,000 individuals whose medical records were stolen in a cyberattack earlier this year. The New Jersey-based company stores patient data for over 45,000 healthcare providers across the country.
According to new filings obtained by TechCrunch, hackers accessed one of CareCloud's six electronic health record data stores for at least six days, from March 10 to March 16. The company acknowledged that the intruder “claimed to have exfiltrated data from databases” but provided no further details. No ransomware group has publicly claimed responsibility for the breach.
The stolen data includes names, postal addresses, Social Security numbers, government-issued identification numbers (such as passports and driver's licenses), financial information like bank account and payment card numbers, as well as extensive medical and health-related information.
CareCloud CEO Stephen Snyder did not respond to TechCrunch's request for comment. The breach involved the company's data storage hosted on Amazon Web Services, as previously reported.
This incident is the latest in a series of cyberattacks targeting healthcare organizations this year. Similar breaches affected TriZetto (3.4 million people), NYC Health + Hospitals (1.8 million people), and UK-based Craneware, which provides software to US healthcare providers.
