← News
/DISPATCH · 2026-08-20

CareCloud Breach Expands to 3.75 Million: AWS Cloud EHR Dump Leaks SSN/Medical Records/Payment Data; Concurrent CEVA Logistics Supply-Chain Incident Hits Pokémon Center/Valve

On 19 August, US healthcare IT vendor CareCloud updated the HHS portal: a 10–16 March AWS cloud intrusion jumped from 350,000 to 3,756,469 affected individuals. Leaked fields include SSN/driver license/medical records/payment data. Same day: CEVA Logistics supply-chain incident, 29 July–1 August, hit Pokémon Center, Valve, ING, Bol customer order data.

Between 18–19 August, CareCloud filed two supplemental disclosures with the U.S. Department of Health and Human Services (HHS) breach-tracking portal: an intrusion into its AWS cloud environment from 10–16 March jumped from ~350,000 affected individuals to 3,756,469. Leaked fields cover name, postal address, Social Security number (SSN), driver license number, date of birth, health insurance information, clinical records, and for a subset, full payment-card and bank-account data. Same-day rollup also covers a 29 July–1 August cyberattack on logistics vendor CEVA Logistics: eight European warehouses halted; order data of retail customers including Pokémon Center, Valve, ING, De Bijenkorf, and Bol was affected. Both incidents put the supply-chain trust line back on the table.

Incident Overview

CareCloud is a U.S.-listed healthcare IT vendor. Mid-March saw an EHR environment outage, followed by an SEC disclosure of an 8-hour network interruption; initial affected count was ~350,000. On 18 August CareCloud first posted the detailed figure 3,371,508 on the HHS portal; on 19 August an HHS update revised it to 3,756,469. HHS confirmed the figure and it is the fifth-largest U.S. healthcare data breach of 2026.

The HHS form also discloses that CareCloud is providing 12–24 months of IDX identity-protection services to affected individuals, coverage cutoff 17 December 2026. Most affected individuals had never dealt with CareCloud directly; the incident is read as a signal to reshape healthcare SaaS trust chains. CEVA Logistics is a contract logistics and fulfillment vendor under France's CMA CGM group. The incident originated in an intrusion starting 29 July; eight European warehouses halted. Multiple retail customers learned their own customers' data had been accessed only after CEVA notices on 1 August. Pokémon Center UK and Germany customers first received fulfillment-anomaly notices in mid-August; the company later disclosed in a second notice that upstream CEVA intrusion was the cause.

Technical Details

Impact Assessment

CareCloud flattening a jump from 350,000 to 3.7 million into official paperwork looks bland; it is the typical large-SaaS pattern of ETL-path inference error plus slow two-layer forensic recheck. The first coarse estimate covered only the subset counted by state AG offices by state-resident numbers; the HHS federal count covers patients nationwide. CareCloud CEO Stephen Snyder has not responded to any questions on whether a ransom was paid, whether a CISO was ever appointed, or future org changes.

CEVA's impact is a different supply-chain curve: the logistics vendor does not face consumers directly, but holds the brand's full order flow (name, address, phone, SKU/qty/price, shipping node). Combined with slower retailer-to-customer notice (Pokémon Center's first email called it a fulfillment anomaly, not a cyberattack), this is a flagship 2026 case of 3PL/fulfillment-side information leak. Purple Shield Security's 19 August recap called both incidents third-party-risk lessons, warning that board comms, regulatory disclosure, and media strategy should reserve revision room beyond the first number—or repeated revisions burn trust.

Remediation

References