MULTIPLE healthcare organisations have disclosed data breaches that together expose the personal information of millions of patients. The CareCloud incident, detailed in a SecurityWeek report shows that over 3.7 million individuals were affected after hackers accessed an AWS environment in March. A separate notice from Brown Health Medical Group‑MA, covered by SecurityAffairs indicates that 311,000 people had their data compromised via a legacy file server in December 2025.
In the CareCloud breach, investigators found that an unauthorized network intrusion in March gave attackers entry to a cloud storage bucket where names, addresses, Social Security numbers and clinical records were stored. The data was copied and removed before the intrusion was detected in July, prompting a revised notification to the Department of Health and Human Services. The Brown Health incident involved a legacy file server that was accessed between 15 and 16 December 2025; the server held employment, financial and medical details but was not connected to the organisation’s electronic health record system.
Neither breach has been linked to a specific CVE identifier, reflecting that the attackers exploited configuration weaknesses rather than a known software flaw. Both incidents were recorded in the HHS breach portal here, which showed the updated figures after initial disclosures underestimated the scope. No ransom demand has been made public and no ransomware group has claimed responsibility for either event.
The lack of a claimed ransomware payload suggests the actors may have been seeking data for resale or espionage rather than immediate extortion. Healthcare continues to be an attractive target because of the high value of personal health information on underground markets. These two disclosures add to a growing tally of large‑scale breaches reported to federal regulators over the past year.
The events underline the risks posed by inadequately secured cloud storage and the persistence of legacy systems that lack modern controls. Misconfigured permissions on AWS buckets can allow anyone with the right network path to read sensitive objects, while outdated file servers often miss critical patches and monitoring.
Defenders should begin by reviewing all cloud storage permissions and enforcing least‑privilege access, ensuring that buckets are not publicly readable and that logs are enabled for any read or delete activity. Legacy servers ought to be isolated from production networks, with strict segmentation and regular vulnerability scans applied. Multi‑factor authentication should be mandatory for any administrative account that can reach these assets.
Organisations should also update their incident response plans to include specific scenarios for cloud data exfiltration and legacy server compromise, and consider offering identity protection services to affected individuals as a mitigation step. Regular staff training on phishing and credential hygiene remains essential, especially as attackers often use stolen credentials to gain the initial foothold.