350,000 Became 3.7 Million Overnight. The First Breach Number You Hear Is Never the Final One.

In early July, CareCloud disclosed that it had detected an intrusion on its network back in mid-March. The disclosure read like most of them do. A window of unauthorized access, an investigation underway, notifications going out.

Then the number started moving.

Data breach reports published by state Attorneys General in July put the total at roughly 350,000 people. Weeks later, the Department of Health and Human Services healthcare breach tracker listed 3,371,508 affected individuals for the same incident on a Monday. By Tuesday the entry read 3,756,469.

That is roughly ten times the earlier figure. The jump was steep enough that it looked like it might be a clerical typo, so SecurityWeek asked. HHS confirmed the number is accurate and reflects the most recent data provided to the agency. At the time of that reporting, the state AG websites still showed the older, smaller counts.

Same breach. Same intrusion window. Same attackers. Nothing about the event changed between Monday and Tuesday. The only thing that changed was how much of the counting had been finished.

A victim count is a running total wearing the costume of a fact

We read breach numbers as though they are measurements. They are closer to invoices arriving in the post.

A victim count is assembled from whatever the breached company has managed to reconcile so far, filed with different regulators on different legal timetables, in different formats, with different thresholds for what triggers a report at all. State Attorneys General publish what they receive. HHS publishes what it receives. Those two feeds are not synchronised, and neither one is the truth. They are snapshots of an ongoing reconciliation.

Which means the direction of travel is almost always the same. Counts go up. Very occasionally a figure is revised down after deduplication, but the structural bias runs the other way, because a company reporting early is reporting on the records it has finished parsing, not on the records that were taken.

CareCloud's own account of the intrusion shows why. The company says threat actors had access to one of its AWS environments between March 10 and March 16, 2026, and that the hackers claimed to have exfiltrated information from databases in that environment. Working out exactly whose rows sat in those databases, across a customer base of healthcare practices, is slow forensic work. The 350,000 figure was never a ceiling. It was a progress report.

If no letter arrived, that is not evidence of anything

This is the practical consequence most people get backwards.

When a breach is announced and no letter shows up, the natural read is relief. In a case where the count multiplies by ten after the first filings, that read does not hold. Roughly 3.4 million people were not in the earlier state disclosures. Every one of them was, for a period of weeks, an uncounted person who had received no notice and had no reason to think about it.

Absence of notification tells you where the paperwork has reached. It does not tell you where the data went.

So the honest posture with any large third-party breach is not to check once and file it away. It is to assume the count is provisional, look at the incident entry again in a month, and act on your own exposure rather than on the arithmetic of the disclosure.

You did not choose CareCloud

Here is the part that separates healthcare breaches from most others.

You did not sign up for CareCloud. You almost certainly had never heard the name before this story. You chose a doctor, or your insurer chose a network, or an employer chose a plan, and somewhere behind that decision a practice picked an electronic health record and billing platform. Your record went where it went.

That is what third-party exposure actually means in practice. Not that a company you use had a bad week, but that your most sensitive records sit in environments you never selected, run by companies you cannot name, under security practices you have no ability to inspect, audit, or refuse.

And the contents here are not trivial. The disclosed categories include names, addresses, Social Security numbers, driver's license numbers, dates of birth, health insurance information, and medical and healthcare information, with full payment card information for a very limited subset of people. That is not a password reset. Most of those fields have no reset button at all.

Meanwhile, three things remain unknown. No known cybercrime group has publicly claimed the attack. CareCloud has not said who was behind it. It is unclear whether a ransom was paid to keep the data from being published. Anyone telling you otherwise is filling in blanks.

The one lever that is genuinely yours

Let us be blunt about the limit here, because pretending otherwise would be insulting.

Redaction would not have prevented this breach. Nothing a patient does hardens somebody else's AWS environment. You cannot patch a vendor, you cannot review its access controls, and in most cases you cannot even find out which vendor holds your chart without asking.

What you can control is how much is in the next copy.

Every medical document you send is a new permanent artifact in someone else's system. A bill emailed to a billing department. An insurance card photographed and uploaded to a patient portal. A driver's license scanned at an intake desk. Each one lands somewhere, gets backed up somewhere, and inherits the security of a company you did not evaluate.

When that recipient has its own bad March, what leaks is whatever you sent. Not what they needed. What you sent.

And the gap between those two is usually enormous, because clinics and billing offices ask for far more than the decision in front of them requires. Intake forms request a full Social Security number out of habit. Billing departments ask for a full card image when they need the last four and an authorisation. Front desks photocopy the whole licence when they are verifying that a face matches a name.

You are allowed to hand over less. A billing dispute needs the account number, the service date, and the amount. Coverage verification needs the member ID, the group number, and the payer. Identity verification at a front desk needs a name, a photo, and an expiry date, not a document discriminator and a full address history.

That is the work RedactID does. You open the file in your browser, black out the fields nobody in the loop needs, and export a flattened document where the hidden text is genuinely gone rather than covered by a rectangle someone can drag away. Nothing uploads and nothing is stored, because it all happens on your device. If we kept your medical bills, we would just be one more environment waiting for its own Monday to Tuesday update.

The practical read

Treat every breach number you see as a figure in progress. Check the HHS tracker entry for an incident more than once. Do not read silence as safety.

Ask your clinic and your insurer who holds your records. You will not always get a clean answer, but the question is legitimate and occasionally illuminating.

Then work the side you control. Before the next bill, card, or licence leaves your hands, cut it down to the decision being made. It does not undo March. It makes the next breach, of whoever you sent it to, a smaller event for you.

Related reading: redacting ID documents before sending them, what to remove from a driver's license, and redacting documents online in general.

If you want to send less without much effort, RedactID is free to use daily, with credit packs and Pro for people doing it often.

Sources: reporting by Eduard Kovacs for SecurityWeek, August 19, 2026, corroborated the same day by TechCrunch, BleepingComputer, and The Record; the HHS healthcare data breach tracker; and data breach reports published by state Attorneys General in July 2026.