CareCloud, a healthcare technology company, has confirmed a significant security incident. Hackers gained unauthorized access to one of its systems that stores electronic health records.
The intrusion occurred on March 16 and lasted for more than eight hours. While CareCloud has restored system functionality, it remains uncertain whether any patient data was actually exfiltrated or what specific information may be involved.
The company has engaged external cybersecurity experts to investigate the breach. Healthcare data is a high-value target for cybercriminals due to its sensitive nature, including names, Social Security numbers, and medical histories. Unlike financial data, medical information cannot be easily changed.
CareCloud serves over 45,000 providers nationwide. The breach highlights the increasing vulnerability of interconnected healthcare infrastructure and the potential risks to millions of patients.
Even if patients have not directly interacted with CareCloud, their data could be affected if their healthcare providers utilize the company's services. The full impact of the breach is still under investigation, and notifications to affected individuals could take weeks or months.
Experts advise vigilance, including monitoring medical statements for unfamiliar charges, considering identity theft monitoring services, and ensuring strong cybersecurity practices like unique passwords and two-factor authentication for patient portals.