WASHINGTON (WOWO) — More than 3.75 million people are affected by a data breach involving CareCloud, a healthcare technology company whose systems are used by medical providers across the country. Federal health regulators say 3,756,469 individuals were affected by the incident, making it one of t he largest healthcare data breaches reported so far this year. The breach involves potentially sensitive information including names and addresses, Social Security numbers, medical and health information, driver’s license numbers, passport information and other government-issued identification. Banking and other financial information may also have been exposed. The incident dates back to March, when CareCloud detected a network disruption and began investigating unusual activity involving one of its Amazon Web Services environments. According to a breach notice filed by the company, an unauthorized third party accessed the AWS environment between March 10 and March 16, 2026. CareCloud brought in outside cybersecurity specialists to investigate the intrusion and determine what information may have been accessed or removed. The company said the attacker claimed to have taken information from databases within the affected environment. CareCloud said it found no evidence of continued unauthorized access after March 16, when the incident was contained. The scope of the breach became significantly clearer after the number of potentially affected people was updated. Earlier disclosures involved a much smaller number of individuals, but federal records now put the total at more than 3.75 million. CareCloud provides electronic health-record technology and other services to healthcare organizations. That means someone does not necessarily have to have a direct relationship with CareCloud to potentially be affected. A doctor’s office, clinic or other healthcare provider could use CareCloud technology to store or process patient information. The type of information involved makes the breach particularly concerning for consumers. A stolen password can generally be changed. A Social Security number, medical history or government-issued identification number cannot simply be replaced. Medical information can also be valuable to criminals because it can be used to make targeted scams appear legitimate. Someone who has a person’s name, healthcare information and other identifying details may be able to create convincing emails, text messages or phone calls pretending to be a medical provider, insurance company or another trusted organization. There is also the possibility of medical identity theft. Criminals can use stolen personal or insurance information to obtain medical services, submit fraudulent insurance claims or otherwise impersonate a victim. Fraudulent information associated with a person’s medical history can potentially create problems that go beyond financial losses. The Federal Trade Commission recommends that people who suspect medical identity theft review their medical records and health insurance statements for anything they do not recognize. That can include unfamiliar healthcare providers, treatments, prescriptions or insurance claims. CareCloud says it reported the incident to law enforcement and took steps to secure the affected environment. The company also says its investigation found no evidence of continued unauthorized activity following containment of the attack. People who received a breach notification from CareCloud should review it carefully because the information exposed may differ from one individual to another. The company has offered complimentary identity-protection services through IDX to affected individuals, according to its breach notification. Anyone receiving a notification should follow the enrollment instructions and check the deadline for signing up. Consumers whose Social Security numbers were exposed should also consider placing a credit freeze with Equifax, Experian and TransUnion. A credit freeze is free under federal law and restricts access to a person’s credit file, making it more difficult for someone to open certain new accounts using stolen information. A freeze does not stop every type of identity theft, however, so consumers should continue monitoring existing financial accounts, credit reports and healthcare records. Bank and credit card statements should be checked for unfamiliar transactions. Credit reports should be reviewed for accounts or inquiries the consumer does not recognize. People should contact their financial institution directly if they discover suspicious activity and should use a trusted phone number or the institution’s official website rather than responding to an unexpected message. Consumers should also be alert for follow-up scams. Someone contacting a victim may already know personal details obtained through the breach. That information should not be considered proof that the caller, texter or email sender is legitimate. Anyone claiming to represent CareCloud, a doctor’s office, an insurance company or a credit-monitoring service should be treated cautiously if the contact is unexpected. Consumers should avoid clicking links in unsolicited messages and should not provide passwords, Social Security numbers, account information or two-factor authentication codes in response to unexpected requests. The breach also highlights a broader issue in healthcare cybersecurity: patients may have sensitive information stored by companies they have never heard of or knowingly dealt with. Healthcare providers routinely depend on outside technology companies to manage electronic medical records, billing, scheduling and other services. A security incident involving one of those vendors can therefore affect large numbers of patients across multiple healthcare organizations. For anyone notified that their information was involved in the CareCloud breach, cybersecurity experts recommend taking action even if there are no immediate signs of fraud. Review the breach notification, determine exactly what information was exposed, use any identity-protection services offered, consider freezing your credit if your Social Security number was involved, and monitor both financial and medical records for suspicious activity. The Federal Trade Commission also operates IdentityTheft.gov, where consumers can report identity theft and receive guidance on recovering from fraud. The CareCloud incident serves as another warning that protecting personal information does not end with securing your own passwords and devices. Sensitive healthcare data can also be exposed through the outside companies that healthcare providers rely on to store and manage patient information. The post CareCloud Data Breach Exposes Medical Records, Social Security Numbers of 3.75 Million appeared first on WOWO News/Talk 92.3 FM and 1190 AM. ...read more read less