Almeida Law Group is investigating a data breach at CareCloud, Inc. The breach occurred on March 10th, 2026. If you were affected, contact Almeida Law Group.
About CareCloud, Inc.
CareCloud, Inc. (Nasdaq: CCLD) is a publicly traded healthcare information technology company headquartered in Somerset, New Jersey. Founded in 1999 as Medical Transcription Billing Corporation and rebranded in 2021, CareCloud provides cloud-based electronic health records, revenue cycle management, practice management, telehealth, and related software to more than 45,000 healthcare providers across over 70 medical specialties nationwide. Because CareCloud operates as a HIPAA business associate to hospitals and physician practices, the environments it manages contain protected health information and other sensitive personal data belonging to millions of patients.
What Happened?
CareCloud, Inc. was listed in a California Attorney General sample breach notice reported on July 25th, 2026. According to that notice and supporting reporting, on March 16th, 2026, CareCloud detected a network disruption in its CareCloud Health division affecting one of its six AWS-hosted electronic health record environments. The company’s investigation determined that an unauthorized third party had access to that environment from March 10th through March 16th, 2026 — approximately eight hours of active intrusion — before CareCloud restored functionality. The attacker claimed to have exfiltrated data from databases within that environment. CareCloud engaged a Big Four accounting firm’s cyber response team, notified law enforcement, and filed a Form 8-K with the SEC on March 24th, 2026, disclosing the incident as material. On June 24th, 2026, CareCloud determined that affected data may have included full names and one or more additional data elements. The notice filename references Social Security numbers, strongly suggesting SSNs are among the potentially compromised data. The notice also states that protected health information may have been affected. No ransomware group had publicly claimed responsibility for the attack as of April 2026.
As of April 2026, multiple law firms — including Edelson Lechtzin LLP, Shamis & Gentile P.A., and Barnow and Associates P.C. — had announced investigations into potential class action lawsuits on behalf of affected individuals. No filed complaints had been confirmed in available sources as of that date.
Key Facts at a Glance
- Company or Organization: CareCloud, Inc.
- Industry: Healthcare Information Technology (Health IT / EHR Provider)
- Location: Somerset, New Jersey
- Incident type: Unauthorized access to an AWS-hosted electronic health record environment; attacker claimed data exfiltration
- Date of breach: March 10th, 2026
- Date breach discovered: March 16th, 2026
- Date of consumer notification: July 25th, 2026
- Identity theft protection offered: 12 or 24 months of IDX credit and CyberScan monitoring, $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery services
- Enrollment deadline: December 17th, 2026
- Litigation status: Multiple law firms announced class action investigations as of April 2026; no filed complaints confirmed
- Source: California Attorney General sample breach notice (https://oag.ca.gov/ecrime/databreach/reports/sb24-627090); HIPAA Journal (https://www.hipaajournal.com/carecloud-data-breach/); TechCrunch (https://techcrunch.com/2026/03/31/carecloud-breach-hackers-accessed-patients-medical-records-ehr/); Newsweek (https://www.newsweek.com/millions-of-healthcare-patients-potentially-affected-by-data-breach-11799231); Edelson Lechtzin LLP via PR Newswire (https://www.prnewswire.com/news-releases/data-breach-alert-edelson-lechtzin-llp-investigates-carecloud-inc-data-breach-302730766.html)
What Should You Do?
If you received a notice from CareCloud, enroll in the free IDX identity protection services before the December 17th, 2026 deadline by visiting https://app.idx.us/account-creation/protect or calling (866) 329-9984. Whether or not you enroll, consider placing a fraud alert or security freeze on your credit files with all three major bureaus — Equifax, Experian, and TransUnion — to block unauthorized new accounts. You can obtain a free copy of your credit report at AnnualCreditReport.com and should monitor it regularly for accounts or inquiries you do not recognize. Because protected health information may have been involved, review your Explanation of Benefits statements from your insurer and request copies of your medical records to check for any unfamiliar treatments or providers. If you find signs of fraud or identity theft, visit IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
