Six days inside, three months to say what left: the CareCloud breach

CareCloud, a health technology provider, is notifying at least 345,000 people that their data was taken in an intrusion earlier this year. According to public reporting from TechCrunch, SecurityWeek, and HIPAA Journal, attackers had unauthorized access to an Amazon Web Services environment hosting one of the company’s electronic health record data stores between March 10 and March 16, 2026. The company detected the incident on March 16 as a network disruption, filed a Form 8-K with the SEC on March 27, completed its determination of what data was involved on June 24, and began mailing notification letters at the end of July. Affected individuals are being offered 24 months of identity theft protection.

The reported data set is the full-value combination: names, addresses, dates of birth, Social Security numbers, driver’s license and government identification numbers, financial account and payment card numbers, and medical and health insurance information. SecurityWeek reports that a limited number of individuals had complete card details exposed, including CVV. TechCrunch reports that no ransomware or extortion group has publicly taken credit. That absence is itself informative. Nothing was locked, no leak site went up, and the first external signal was a notification letter four and a half months after the fact.

It is worth separating the two numbers, because organizations routinely try to fix them with the same budget. Six days of unauthorized access is a detection gap. Three and a half months from intrusion to a defensible statement about what was taken is a forensics gap. Improving one does very little for the other.

Detection at the data layer addresses the first. Copying a health record repository is a read pattern, and it is a distinctly abnormal one: an account or session touching volumes and file paths it has no working relationship with, at a rate no clinician or billing workflow produces. Endpoint and network tooling sits upstream of that read and generally sees an authorized session moving expected protocols. Something evaluating each operation against a learned baseline of normal access sees the shape of the thing directly, which is what makes a six-day window a six-minute one.

The second number is answered by audit, and specifically by audit an attacker cannot alter. A per-operation, immutable record of which identity read which object, from which host, at which timestamp turns scoping from an inference exercise into a query. Much of the three and a half months in incidents like this goes to reconstructing that record from partial telemetry: cloud logs with retention limits, application logs that record sessions rather than objects, and backups that show what existed without showing who read it.

Companies in this position are frequently criticized for slow notification, and the criticism usually misreads the mechanics. You cannot notify people accurately until you know which people. When the evidence is thin, the choices are to over-notify, which is expensive and erodes the signal for the recipients who are genuinely at risk, or to keep investigating, which costs months. Neither is a good option, and the choice between them was determined months earlier by what the architecture recorded.

This could be nearly any organization holding regulated records in a cloud-hosted environment. The pattern is common because the instrumentation is common: strong controls at the identity and network boundary, and a data layer that faithfully serves reads without forming an opinion about them. When the boundary is crossed, there is nothing downstream that both watches and remembers.

Healthcare records draw this attention because they monetize in more ways than any other record type, and because the file estate behind an EHR platform is large, old, and reachable over SMB, NFS, S3, and Web Drive. That makes NAS security a clinical-risk question rather than an infrastructure one, and instrumenting it means three specific things, in the order they take effect. Attribute-based access control evaluates user, host, application, and data attributes on every operation, so one compromised session is confined to what that identity legitimately needs instead of inheriting a group membership granted years ago. Active Defense profiles normal access per user, host, and dataset and evaluates each file operation inline in the data path, so a session reading a records repository at a rate no clinical or billing workflow produces can be terminated while the copy is still running. ImmutaVault holds the per-operation record the attacker cannot edit, which is what turns the scoping question into a query with an answer on day two.

None of this is a recent argument. RackTop filed the Active Defense patent on September 8, 2020, ten months before Gartner named the Cyberstorage category in July 2021, and it has shipped inline in the data path since October 2020. It is one of four U.S. patents on the architecture.

Backup and vaulting matter, and they answer a different question. They restore data that was destroyed or encrypted. Here nothing appears to have been destroyed, so there was nothing to restore, and the entire cost landed in disclosure, credit monitoring, regulatory exposure, and the trust of people who never chose their provider’s software vendor. When recovery is not the problem, the only controls that change the outcome are the ones that see the read.