CareCloud has confirmed that attackers stole medical records belonging to 3.7 million patients.
The healthcare technology company confirmed the breach, saying hackers didn't just access patient files but took them. CareCloud has not detailed how the intruders got in, what specific fields were included in the stolen records, or when the theft actually occurred. What it has confirmed is the scale: by patient count, this ranks among the largest healthcare data breaches reported in the US so far this year.
That scale matters more in healthcare than almost anywhere else. A stolen credit card number gets canceled and reissued in a week. A stolen medical record, including diagnoses, prescriptions, and insurance details, stays valid and useful to a scammer for the rest of a patient's life. Breaches like this one turn into years of identity-theft risk, not a single bad news cycle.
Healthcare has become one of the most reliably breached industries precisely because patient data is that durable. CareCloud's disclosure reads like dozens before it: a confirmed number, a vague description, and presumably a credit-monitoring offer to follow. The pattern is familiar. The fix for it still isn't.