CareCloud breach exposes 3.7 million patient medical records

The New Jersey-based firm, which provides storage for electronic medical records across the United States, disclosed the scale of the theft to the Department of Health and Human Services this week. Stolen files contain a high-risk mix of sensitive information, including Social Security numbers, passport details, driver’s licenses, and private banking data. Hackers maintained access to the company's cloud storage for six days, exfiltrating patient billing and health history records before the intrusion was identified.

Despite the severity of the exposure, CareCloud chief executive Stephen Snyder has remained silent, failing to address inquiries regarding the potential payment of a ransom or the internal accountability for the security failure. The incident follows a pattern of large-scale healthcare vulnerabilities this year, trailing the 15 million records lost by DentaQuest and significant breaches at TriZetto and Craneware. The company has not provided updates on whether the current victim count, which was revised upward on Tuesday, is expected to climb further.