HackingHealthcareTechnologyHealthcareStolen CredentialsCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountHighContained

CareCloud, Inc.

bd_1e42ced8f1d65dd9 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 16, 2026

Filed

Jul 31, 2026

To disclose

20 weeks

Affected

68,886state residents only

Linked

10 filings

Confidence

66%

Full breach record for CareCloud, Inc. →2 incidents on file

CareCloud, Inc. notified the New Hampshire Attorney General on July 31, 2026, of a breach affecting approximately 68,886 NH residents. Between March 10 and March 16, 2026, an unauthorized third party accessed a CareCloud AWS environment and exfiltrated data. Affected data included names, SSNs, DOBs, driver's license numbers, and PHI (health insurance, medications, allergies). Credit card info (including CVV) was affected for a limited subset. CareCloud engaged forensic investigators, reported to law enforcement, and is offering credit monitoring and identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 20 weeks / 137 days

Mar 10, 2026

Begins

Mar 16, 2026

Discovered

Jul 31, 2026

Filed

vs. sector median

+7 wks slower

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Texas State AGbd_5be63a5d95dd65f12026-07-28 · +3dVerified
Oregon State AGbd_42df04e823fae0162026-08-04 · +4dVerified
South Carolina State AGbd_761c52aedc1f32012026-08-06 · +6dVerified
Massachusetts State AGbd_a0ddde8d6666ff312026-07-25 · +6dVerified

Show 5 more filings ↓up to 137d gap

California State AGbd_c48fbacd970b0fb72026-07-25 · +6dVerified
HHS OCRbd_3b7e00e7a7706e032026-07-24 · +7dVerified
Washington State AGbd_ace296eeb27ef3e52026-07-24 · +7dCandidate
SEC 8-Kbd_5d230f4ceefa826c2026-03-27 · +126dVerified by operator
Pressbd_7b45c93daf45a5c62026-03-16 · +137dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: CareCloud, Inc.
norm: carecloud
Domain: carecloud.com
Industry: HealthcarellmTechnologyllm

Discovered: Mar 16, 2026
Breach occurred: Mar 10, 2026 – Mar 16, 2026
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 24, 2026
Affected individuals: 68,886state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a leading cyber response advisory team to assist with securing the environment and conduct a comprehensive forensic investigation
Reported the matter to the appropriate law enforcement authorities
Provided written notification of this incident commencing on or about July 24, 2026
Offered complimentary memberships with a credit monitoring service for affected residents whose Social Security numbers were impacted
Advised affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Changes made: Secured the affected environment
Eliminated the threat
Confirmed that no persistent unauthorized access remained
Continuing to strengthen the security of its systems and environments
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(137 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

PressMar 16 · first

SEC 8-K+11d

HHS OCR+130d

Washington State AG+130d

Massachusetts State AG+131d

California State AG+131d

Texas State AG+134d

New Hampshire State AG+137d · this page

Oregon State AG+141d

South Carolina State AG+143d

Pattern: first filing Mar 16, last Aug 6 (SC) — a 143-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/carecloud-20260731.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2026
Raw hash: 2462c788f1e57b88c96a259225c878b1d064e67de3d6e1e5f09e398e105b8193

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityCareCloud, Inc.

Incidentdiscovered Mar 16, 2026

Stated responseEngaged a leading cyber response advisory team to assist with securing the environment and conduct a comprehensive forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov