CareCloud hit by data breach that could impact millions
Healthcare IT infrastructure and electronic health record company CareCloud confirmed in a regulatory filing that it’s suffered a data breach, said to have impacted one of its six patient record stores, with hackers inside its network for "approximately eight hours.”
The “cybersecurity incident” was disclosed in a filing with the U.S. Securities and Exchange Commission, and said the incident occurred on March 16. The company said that, while intruders did access patient medical records, it wasn’t clear if any data was stolen.
An investigation into the data breach is still ongoing, and CareCloud said it's working with a third-party cybersecurity organization to gather the details. After some downtime, CareCloud said it believes the invasion has been thwarted and that criminals no longer have a way inside its network.
Systems were taken down and restored the same day. Details such as how the cyberattack was conducted and if any ransomware was deployed was not revealed. It’s also not clear if any notable cybercrime syndicate was behind the data breach, nor whether those responsible made any demands.
The filing with the SEC was released on March 24, and there hasn’t been any real update from the company since.
Public records show that CareCloud uses Amazon Web Services as its data host, and it’s unknown if hackers were able to gain access to that environment.
For now, it’s not even clear if hackers were able to access primary records or backups, and it’s unknown if protected health information was accessed. If it was, the company and any associated providers will be responsible for notifying victims of the data breach.
A nationwide impact
CareCloud has medical records on millions of patients. The publicly traded EHR vendor has more than 45,000 customers, all of whom are provider groups, hospitals and medical practices from across the U.S.
The company did say in its SEC disclosure that the incident may impact its business, and was therefore required under federal law to notify investors of the data breach. As for what that impact will be, that remains to be seen and will likely be determined once the investigation concludes.
HealthExec reached out to CareCloud for more information, including whether or not ransomware was deployed and what types of sensitive data hackers gained access to during the attack.
This is a developing story.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.