CareCloud’s data breach now affects more than 3.7 million people, ten times the roughly 350,000 the healthcare technology company disclosed to state attorneys general starting July 25, when it began mailing notification letters.
The gap surfaced this week through the Department of Health and Human Services’ breach portal, not through any new CareCloud statement. Filings CareCloud submitted to state attorneys general in late July put the number far lower, with individual states reporting counts in the tens of thousands and a combined total near 350,000. By Monday, August 17, the HHS Office for Civil Rights tracker listed 3,371,508 affected individuals. A day later, that figure climbed to 3,756,469.
SecurityWeek, which first reported the discrepancy, contacted HHS and was told the current number is accurate and not a typo.
CareCloud, a Somerset, New Jersey-based EHR and practice management vendor serving more than 45,000 healthcare providers nationwide, first disclosed a network disruption on March 27, after an unauthorized party accessed one of its AWS environments between March 10 and March 16. The company completed its forensic review on June 24 and began notifying individuals a month later. Breached data includes names, addresses, Social Security numbers, driver’s license numbers, dates of birth, health insurance details, and medical records. A small subset of victims also had full credit/debit card data exposed.
[Related: Is ‘The Pitt’ Ransomware Attack Realistic? One CISO Says Yes]
No ransomware or extortion group has claimed responsibility, and it remains unclear whether CareCloud paid a ransom.
CareCloud chief executive Stephen Snyder has not responded to multiple requests for comment on the incident, including questions about whether the company paid a ransom or who is responsible for cybersecurity at the company, TechCrunch reported.
Healthcare remains the most expensive sector for breach response for a 14th consecutive year, averaging $7.42 million per incident and 279 days to identify and contain, according to IBM’s 2025 Cost of a Data Breach Report.
The gap between CareCloud’s state notifications and the federal count is not unprecedented.
HIPAA allows entities to file an initial breach report with a placeholder estimate while an investigation continues, then amend the total later, the same mechanism that let 2024’s Change Healthcare breach balloon from an initial 500-person placeholder to 192.7 million.
CareCloud’s jump is far smaller in absolute terms but follows the identical pattern of an early, conservative number followed by a federal correction once the fuller scope of the AWS intrusion came into focus, five months after the breach was first detected.
CareCloud has not said whether more revisions are coming. The HHS tracker has moved twice in two days, and the company’s own state filings, still sitting at roughly 350,000, have not been updated to match.
