On March 16, 2026, CareCloud, a New Jersey-based healthcare SaaS provider, confirmed unauthorized access to one of its six EHR environments, resulting in confirmed patient data exposure and an eight-hour network disruption. The breach affects downstream medical practices using CareCloud’s revenue cycle management, practice management, and patient experience platforms, with full patient impact scope still undetermined. SEC disclosure has been filed; organizations relying on CareCloud as a third-party SaaS vendor face both direct data exposure risk and regulatory notification obligations under HIPAA.