UnknownHealthcareMedium

CareCloud, Inc.

bd_42df04e823fae016 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 16, 2026

Filed

Aug 4, 2026

To disclose

20 weeks

Affected

57,920

Linked

10 records

Confidence

95%

Full breach record for CareCloud, Inc. →2 incidents on file

CareCloud, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2026-08-04. The breach occurred during 3/16/2026 - 6/24/2026. The breach was discovered on 3/16/2026. 57,920 individuals were affected. Notice was sent on 7/24/2026.

J jump to incidentP pin to compareR raw source

Oregon clock✗ OR AG >45d20 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 20 weeks / 141 days

Mar 16, 2026

Begins

Mar 16, 2026

Discovered

Aug 4, 2026

Filed

This filing is one of 10 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

South Carolina State AGbd_761c52aedc1f32012026-08-06 · +2dVerified
New Hampshire State AGbd_1e42ced8f1d65dd92026-07-31 · +4dVerified
Texas State AGbd_5be63a5d95dd65f12026-07-28 · +7dVerified
Massachusetts State AGbd_a0ddde8d6666ff312026-07-25 · +10dVerified

Show 4 more filings ↓up to 130d gap

California State AGbd_c48fbacd970b0fb72026-07-25 · +10dVerified
HHS OCRbd_3b7e00e7a7706e032026-07-24 · +11dVerified
Washington State AGbd_ace296eeb27ef3e52026-07-24 · +11dCandidate
SEC 8-Kbd_5d230f4ceefa826c2026-03-27 · +130dVerified by operator

Press reports (1)

Pressbd_7b45c93daf45a5c62026-03-16 · +141dVerified by operator

Name: CareCloud, Inc.
norm: carecloud
Domain: carecloud.com

Name: CareCloud, Inc.
norm: carecloud
Domain: carecloud.com

Discovered: Mar 16, 2026
Breach occurred: Mar 16, 2026 – Jun 24, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 24, 2026
Affected individuals: 57,920nationwide
Data types: —
Attack vector: Unknown

Time to disclose: 20 weeks(141 days from discovery to filing)
Compliance flags: OR AG >45d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

SEC 8-KMar 27 · first

HHS OCR+119d

Washington State AG+119d

Massachusetts State AG+120d

California State AG+120d

Texas State AG+123d

New Hampshire State AG+126d

Oregon State AG+130d · this page

South Carolina State AG+132d

Pattern: first filing Mar 27, last Aug 6 (SC) — a 132-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://justice.oregon.gov/consumer/DataBreach/
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2026
Raw hash: 7538db243b00e734fab9005f4754b8f9b200e350b8a204036ae83e127d46419c

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Press reports (1)

Reporting entityCareCloud, Inc.

Victim entityCareCloud, Inc.

Incidentdiscovered Mar 16, 2026

ComplianceOR AG >45d

Extraction provenanceno artifact recorded

Source provenancejustice.oregon.gov