CareCloud Data Breach Lawsuit Investigation
Received a July 2026 breach notice from CareCloud?
Dapeer Law, P.A. is investigating a potential class action against CareCloud, Inc., a healthcare technology company that provides electronic health record and practice-management services, on behalf of individuals whose personal and protected health information may have been exposed in a cyber incident affecting one of its Amazon Web Services environments.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from CareCloud dated July 2026.
- Your letter offered enrollment in free IDX identity protection, including credit and CyberScan monitoring and a $1,000,000 insurance reimbursement policy.
- You had personal or protected health information held by CareCloud in its capacity as an electronic health record and practice-management provider.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
On March 16, 2026, CareCloud, Inc. discovered a network disruption in its CareCloud Health division that affected one of its electronic health record environments. The company opened an investigation, engaged an outside cyber-response advisory team, secured the affected environment, and reported the matter to law enforcement. A forensic investigation determined that, between March 10 and March 16, 2026, an unauthorized third party accessed one of CareCloud's Amazon Web Services (AWS) environments and claimed to have exfiltrated data from databases within that environment. CareCloud has stated there is no evidence of unauthorized activity in its environment after March 16, 2026.
CareCloud completed its review of the affected data on June 24, 2026 and began mailing notification letters on or around July 25, 2026, roughly four months after discovering the incident. The company reported the breach to the California and Massachusetts Attorneys General. According to the notices, the affected data may include your full name together with one or more additional data elements; the California filing was categorized as involving Social Security numbers, and CareCloud describes the information as protected health information. Individual letters specify the exact data elements involved for each recipient. CareCloud has said it is not aware of any reports of identity fraud or misuse resulting from the incident as of the date of its notice.
Because CareCloud provides electronic health record and clinical documentation services to healthcare organizations, the information held in its systems can include sensitive health and identifying details. Exposure of that type of information can raise the risk of medical identity theft and financial fraud, which is why affected individuals are generally encouraged to review their notice, monitor their accounts, and consider the protective steps described below.
What to do if you received a letter
Keep your notice letter
Do not discard it. Your letter contains the IDX enrollment code and identifies the specific data elements involved, both of which are important if you decide to participate in a lawsuit.
Enroll in the free IDX identity protection
Enroll in the IDX credit and CyberScan monitoring offered in your letter before the December 17, 2026 deadline. The package also includes a $1,000,000 insurance reimbursement policy and fully managed identity-theft recovery services. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring CareCloud to implement stronger data security practices going forward.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from CareCloud. What should I do? +
Keep your CareCloud letter, enroll in the free IDX identity protection (credit and CyberScan monitoring) before the December 17, 2026 deadline, and consider placing a fraud alert or security freeze on your credit files. Because CareCloud handles health information, also review your explanation of benefits statements for services you do not recognize. You can then contact a data breach attorney for a no-cost review of your legal rights.
Am I eligible to join a class action against CareCloud? +
If you received CareCloud's July 2026 notice, you are a confirmed notice recipient and may qualify to participate in a class action or individual case. Eligibility can depend on your state of residence, the categories of data exposed in your specific letter, and any documented losses.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
CareCloud has stated that the affected data may include your full name together with one or more additional data elements. The California Attorney General filing was categorized as involving Social Security numbers, and CareCloud describes the information as protected health information. Your individual letter lists the exact data elements involved for you, so it is the most reliable source.
Did CareCloud offer free credit monitoring? +
Yes. CareCloud is offering free identity protection through IDX, including 12 or 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity-theft recovery services. The enrollment deadline stated in the notice is December 17, 2026. Enrolling does not waive your right to pursue legal action.
How many people were affected by the CareCloud breach? +
Regulatory filings indicate that 72,102 individuals were notified. This page will be updated if additional figures are disclosed.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The notice was filed with the California Attorney General's data breach portal and with the Massachusetts Attorney General. You can obtain a copy from those state portals, or Dapeer Law can help you request one during a free consultation.
Sources & references
- Official breach notice filing · California Attorney General notice (PDF)
- Official breach notice filing · Massachusetts Attorney General notice (PDF)
- Company · CareCloud, Inc. (carecloud.com)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
