CareCloud disclosed a cybersecurity incident affecting one of its six electronic health record (EHR) environments. The company said the disruption lasted about eight hours and was contained on March 16, 2026. A later California Attorney General listing records CareCloud with a breach date of March 10 and a report date of July 25, 2026. Those records make this more than a service-outage story, but the public sources cited here do not establish how many people were affected or whether information was copied out of the system.
What happened at CareCloud?
CareCloud said a cybersecurity incident affected its CareCloud Health division on March 16, 2026. Functionality and data access were disrupted in one of six EHR environments for approximately eight hours. The company said it restored access and contained the incident that evening, then began a forensic investigation to determine whether patient information or other data had been accessed or exfiltrated. CareCloud’s Form 8-K describes the company’s account of the incident.
CareCloud said it engaged its cyber-insurance carrier and an external cyber-response team affiliated with a Big Four accounting firm. It also said it believed the incident was limited to the affected CareCloud Health environment and did not affect its other platforms, divisions, systems, data, or environments. That is the company’s stated assessment, not evidence that every possible consequence has been ruled out.
Why it is now a data-breach story
The March SEC disclosure called this a cybersecurity incident and said the company was still investigating whether information had been accessed or taken. California’s Attorney General breach database later listed CareCloud, Inc., with a breach date of March 10, 2026, and a reported date of July 25, 2026. That state filing supports treating the event as a reportable breach, but the listing does not provide a national affected-person total or settle the question of what data was removed. See the California Attorney General breach database.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Unauthorized access, data theft, and service disruption are different questions. The system interruption lasted about eight hours; that does not establish how long an intruder may have had access. Nor does a breach notice by itself show that every record in the environment was accessed or exfiltrated.
Incident timeline
| Date | What the public record says |
|---|---|
| March 10, 2026 | The date California’s breach database lists for the CareCloud breach. |
| March 16, 2026 | CareCloud’s SEC filing says it experienced a network disruption affecting one EHR environment; access was restored and the incident contained that day. |
| March 24, 2026 | CareCloud determined the incident was material, according to its filing. |
| March 27, 2026 | CareCloud filed its Form 8-K with the SEC. |
| July 25, 2026 | The date California’s database gives for the reported breach. |
The March 10 and March 16 dates are not reconciled in the cited records. March 10 could reflect a different point in the incident than the March 16 discovery or service disruption, but the available sources do not confirm that explanation.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What information may have been exposed?
The affected EHR environment contained patient and healthcare records, according to reporting about the incident. However, CareCloud’s SEC filing does not specify which data elements were accessed or exfiltrated. It does not confirm exposure of Social Security numbers, insurance identifiers, diagnoses, treatment details, financial information, account credentials, or any particular volume of records.
California’s breach-reporting process includes fields for categories such as medical information, health-insurance information, Social Security numbers, financial information, and credentials. Those are categories the state form can capture; the form’s existence does not establish that each category was involved in CareCloud’s incident. California’s breach-reporting page explains the reporting process.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How many people were affected?
The cited authoritative records do not establish a final total. Claims of hundreds of thousands of affected people should not be treated as confirmed without an underlying company notice or regulator filing. A state notice can reflect only that state’s reporting and may not give the national count; patient totals, record totals, and state-specific counts are not interchangeable.
What patients can do
If you receive a notice, follow its specific instructions: the data involved and any offered services should determine your next steps. If you have not received one, do not assume either that you were affected or that you were not; ask your healthcare provider whether its CareCloud environment was involved.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Verify the notice. Contact your provider using a phone number from its established website or paperwork, rather than relying on links or numbers in an unexpected message. CareCloud lists customer support at 877-342-7517 and a compliance hotline at 732-873-5133 on its official contact page.
- Use any offered help. If your individual notice provides free credit monitoring or identity-restoration services, review the terms and enrollment deadline before deciding whether to enroll.
- Check healthcare and financial activity. Review medical bills, explanation-of-benefits statements, insurance claims, and account activity for unfamiliar services or charges. Contact the provider or insurer about anything you do not recognize.
- Secure accounts. Change reused passwords on affected accounts and enable multifactor authentication where available. Be especially cautious of messages about appointments, claims, or prescriptions that ask you to open a link or disclose a password.
- Consider a credit freeze if sensitive identity data is confirmed exposed. A freeze can restrict access to your credit file for new-credit applications; monitoring may alert you to some activity but does not prevent it. A freeze is most pertinent if your notice says Social Security numbers or other credit-application identifiers were involved.
- Report suspected medical identity theft. Notify your healthcare provider, health insurer, and any affected financial institution. California’s privacy agency also advises people to change compromised passwords, review accounts and medical statements, and use official sites rather than unsolicited-message links in its breach-monitoring guidance.
What CareCloud customers and providers should ask
Healthcare organizations should get a direct, written scope assessment from CareCloud rather than infer exposure from the fact that one of six environments was affected.
- Was the organization’s tenant or patient population in the affected EHR environment?
- Which data elements and date ranges are potentially involved, and what is known about access, exports, or exfiltration?
- Has CareCloud completed containment, eradication, and recovery, and what evidence can it provide?
- What access logs, privileged-account events, exports, API activity, or downstream transfers should the provider review?
- Do credentials need resetting, particularly reused administrative credentials, and are additional access controls appropriate?
- What notification duties apply under the organization’s contracts and applicable law? Responsibilities depend on the provider’s role, the information involved, and the relevant jurisdiction, so organizations should consult their privacy and legal teams.
- Are backups intact, restoration procedures validated, and relevant logs and communications preserved for regulatory, legal, and insurance needs?
- How will the organization handle patient questions and possible fraudulent claims, prescription activity, or social-engineering attempts?
What remains unresolved
- Whether unauthorized access resulted in information being copied or exfiltrated.
- Why California lists March 10 while CareCloud’s SEC filing centers on March 16.
- The categories and volume of information involved.
- The number of affected people and states, and whether all potentially affected individuals have been notified.
- The threat actor, attack method, any ransom demand, and whether law enforcement is involved.
- Whether regulators have taken further action or the forensic investigation has produced a final public account.
CareCloud’s filing does not identify a threat actor or confirm ransomware, and it does not establish that no patient data was taken. The SEC filing and California listing provide the clearest public status in the sources cited here; neither answers all of these questions.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
