CareCloud's AI-powered EHR just leaked 3.75 million patients' medical records. The CEO won't pick up the phone.

CareCloud confirmed 3.75 million patients had their medical records stolen.

That makes it the fifth-largest healthcare data breach of 2026.

Here is what makes this worse than the headline.

CareCloud provides AI-powered electronic health records to 45,000 healthcare providers across the United States.

Hospitals, clinics, doctor's offices.

The attackers were inside CareCloud's AWS environment for six days. March 10 to March 16.

They exfiltrated names, Social Security numbers, medical diagnoses, treatment records, prescription histories, government IDs, and financial account information.

The full scope of PHI. The kind of data that cannot be cancelled like a credit card.

CareCloud's CEO Stephen Snyder has not responded to a single email from TechCrunch asking whether the company paid the ransom, who is responsible for cybersecurity at the company, or whether he plans to resign.

Zero public comment since March.

This is what downstream AI risk looks like. CareCloud handles patient data on behalf of 45,000 providers. Every one of those providers now faces breach notification obligations, HIPAA liability, and potential regulatory action because of a vendor they trusted with their most sensitive data.

Audit your EHR vendor chain today. If your AI-powered healthcare platform stores PHI in plaintext and cannot answer basic questions about its security posture after a breach, you are one incident away from a compliance catastrophe that dwarfs anything your security team has budgeted for.

SOURCE: https://techcrunch.com/2026/08/19/carecloud-confirms-3-7m-patients-had-their-medical-records-stolen-in-data-breach/

VERIFIED: TechCrunch (Aug 19, 2026), HIPAA Journal (Aug 18, 2026), HHS Office for Civil Rights breach portal

SIGNAL: This is the fifth-largest US healthcare breach of 2026. CareCloud is an AI-powered EHR vendor serving 45,000 providers. The CEO's silence signals governance collapse. Every enterprise using CareCloud now faces downstream HIPAA liability.