HHS now says CareCloud’s March intrusion exposed data on 3,756,469 people, up from the roughly 350,000 named in early state notices. CareCloud’s cloud-based healthcare platform serves thousands of providers, so the incident reaches well past one company database and into a record system used across many practices.
CareCloud found that attackers had access to one of its Amazon Web Services environments for about a week in March and later said data was exfiltrated from databases there. The stolen records included names, addresses, Social Security numbers, driver’s license numbers, dates of birth, insurance details, and medical information; a small subset also included full payment card data.
For healthcare groups that outsource EHR or billing to a cloud provider, the exposure sits in the provider’s environment and any copied records downstream from it. The revision also shows why early breach notices can understate the final blast radius by an order of magnitude or more.