Cyberattack at CareCloud (CCLD) hits one EHR system but is contained
Rhea-AI Filing Summary
CareCloud, Inc. reports a material cybersecurity incident involving its CareCloud Health division. On March 16, 2026, a temporary network disruption affected 1 of its 6 electronic health record environments for about eight hours until functionality and data access were fully restored that evening.
The incident, believed to be caused by an unauthorized third party, appears contained to the CareCloud Health environment. CareCloud engaged a Big Four cyber response team, notified its cybersecurity insurer, and reported the matter to law enforcement. The company is still determining whether, and to what extent, patient information or other data was accessed or exfiltrated.
CareCloud states that, as of this report, the incident has not had a material impact on operations and is not reasonably likely to have a material impact on its financial condition or results of operations. It nevertheless deems the incident material due to the sensitivity of potentially affected data and potential remediation, legal, regulatory, notification, and reputational consequences.
Positive
- None.
Negative
- None.
Insights
CareCloud discloses a contained but material cyber incident with limited expected financial impact.
CareCloud describes an eight-hour disruption limited to 1 of 6 electronic health record environments in its CareCloud Health division. Operations and data access were restored the same day, and other platforms and systems are believed to be unaffected. The company quickly brought in a Big Four cyber response team and notified its cybersecurity insurer.
The company is still investigating whether patient information or other data in the affected environment was accessed or exfiltrated, which is the key remaining uncertainty. It labels the incident material mainly because of potential remediation, legal, regulatory, notification, and reputational consequences, not because of current operational or financial impact.
CareCloud currently believes the incident is not reasonably likely to have a material impact on its financial condition or results of operations, though the full impact is undetermined. Future updates may come through amended disclosures once the ongoing forensic investigation clarifies data exposure, notification obligations, and any regulatory responses.
8-K Event Classification
FAQ
What cybersecurity incident did CareCloud (CCLD) report in March 2026?
Did the CareCloud (CCLD) cybersecurity incident affect patient data?
How has CareCloud (CCLD) responded to the March 2026 cyber incident?
What impact does CareCloud (CCLD) expect from the cybersecurity incident on its business?
Why did CareCloud (CCLD) deem the cybersecurity incident material if operations were quickly restored?
AI-generated analysis. How Rhea-AI works. Not financial advice.
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM
CURRENT REPORT
Pursuant to Section 13 or 15(d) of the
Securities Exchange Act of 1934
Date
of Report (Date of earliest event reported):
(Exact name of registrant as specified in its charter)
(State or other jurisdiction of incorporation) |
(Commission File Number) |
(IRS Employer Identification No.) |
(Address of principal executive offices, zip code)
(Registrant’s telephone number, including area code)
Not
Applicable
(Former name or former address, if changed since last report)
Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:
| Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425) | |
| Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12) | |
| Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b)) | |
| Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c)) |
Securities registered pursuant to Section 12(b) of the Act:
| Title of each class | Trading Symbol(s) | Name of each exchange on which registered | ||
Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).
Emerging
growth company
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐
Item 1.05 Material Cybersecurity Incidents.
The
Company further believes that the incident was contained to the CareCloud Health environment and did not affect the Company’s other
platforms, divisions, systems, data or environments. The incident was contained on the day it was discovered. The Company believes that
it has sufficient cybersecurity insurance coverage for any potential losses.
All affected systems have been fully restored, and the Company believes that the threat actor no longer has any access to the same. As part of its remediation efforts, the Company is working with its outside cybersecurity experts to further reinforce its information technology systems and to prevent future unauthorized access.
As
of the date of this Current Report on Form 8-K,
| 2 |
Cautionary Statement Regarding Forward-Looking Statements
Item 9.01 Financial Statements and Exhibits.
(d) Exhibits
| 104 | Cover Page Interactive Data File (embedded within the Inline XBRL document) |
| 3 |
SIGNATURE(S)
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.
| CareCloud, Inc. | |||
| Date: | March 27, 2026 | By: | /s/ Norman Roth |
Norman Roth | |||
| Interim Chief Financial Officer and Corporate Controller | |||
| 4 |