Data belonging to 3.75 million patients was exposed in the CareCloud breach – not the 350,000 originally reported

The number of victims affected in the CareCloud breach has been revised from 350,000 to roughly 3.75 million, the company has revealed.

The American medical record storage first confirmed it had been breached back in March, with hackers gaining access to medical data held in its cloud over six whole days.

According to regulatory filings from CareCloud at the time, the intrusion was spotted on 16 March. An investigation into the incident found an unauthorized party had gained access to an AWS environment for several days.

The initial filing said the attack caused a network outage of eight hours, disrupting access to the impacted database.

CareCloud noted the hackers "claimed to have exfiltrated data from databases within that environment", though the nature of the attack and whether CareCloud was directly communicating with the attackers remains unclear.

Reports suggest no hacking group has as yet claimed responsibility for the attack.

After CareCloud spotted the incident, access was shut down and no further unauthorized activity was spotted.

CareCloud breach notices cited far lower victim numbers

In July, disclosure letters were distributed to around 350,000 people in the US who were believed to be affected — but that has since risen to 3.75 million potential victims.

Leaked data includes names and addresses, as well as more sensitive details such as bank accounts, payment card numbers, medical data, and government identification including driver's licenses, passports, and Social Security numbers.

Ross Filipek, CISO at Corsica Technologies, said the revision to the victim list highlights the disastrous impact of cyber attacks on healthcare organizations – which rank among the top targets for cyber criminals.

"This isn't just a massive breach of data, it's a warning," Filipek commented. "Nearly four million patients having their information exposed shows just how much sensitive data can be concentrated behind a single healthcare technology provider."

"It also creates significant legal and regulatory exposure for a provider handling this much protected health information, which could make the fallout expensive for CareCloud."

What's next?

CareCloud hasn't revealed much detail about the attack – including whether it was ransomware or a ransom was paid – but the company says its continuing to investigate and lockdown systems.

"Upon discovering the incident, CareCloud quickly launched an investigation and took steps to contain and remediate the issue," a spokesperson said, per reports from Teiss.

"CareCloud engaged external cybersecurity experts and, with their assistance, secured the affected environment, eliminated the threat, and confirmed that no persistent unauthorized access remained. CareCloud is continuing to strengthen the security of its systems and environments."

ITPro approached CareCloud for comment, but did not receive a response by time of publication.

Disclosure letters distributed to affected patients note the company has seen no attempts at identity fraud to date, but warns recipients to be mindful of misuse of the stolen information.

Data exposed in the breach gives cyber criminals “plenty to work with long after the initial incident is over,” Filipek said.

Hackers often use exposed information such as email addresses and phone numbers in follow-up scams in the wake of a cyber attack or breach.

"For patients, the risk doesn’t stop at identity theft," noted Filipek. "Stolen health information can fuel highly convincing phishing, medical fraud, and other scams built around deeply personal details."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.