When the Cloud Fails: Millions of Patient Records Exposed in a String of Healthcare Breaches

Imagine trusting your doctor's office with your Social Security number, your diagnosis history, your insurance details, and then finding out that information sat in a database you never knew existed, at a company you never chose, until a stranger walked out with it. That's the reality facing more than 13 million people right now, and it's a reality that keeps repeating itself.

CareCloud, a company that builds electronic health record and billing software, confirmed this past month that a hacker got into one of its Amazon Web Services environments. According to the HHS Office for Civil Rights breach portal, that incident compromised the electronic health information of more than 3.7 million people. Just weeks later, Aesto Health, a data migration and management firm, reported an even larger incident to federal regulators: a breach that occurred back in December but affected a staggering 9.5 million individuals.

These aren't isolated events. Medical device maker Medtronic disclosed a breach earlier this year tied to the Salesforce Experience Cloud. McKesson, the pharmaceutical distribution giant, reported data extracted via Salesforce and the AI data platform Snowflake. In both of those cases, the ShinyHunters ransomware group claimed responsibility, reportedly using "vishing," a phone-based social engineering tactic, to trick employees into handing over their login credentials.

Pete Basica, founder and chairman of the digital therapeutics platform 360, has spent time picking apart what these incidents actually reveal. And his central point cuts against the instinct to point fingers at the cloud itself.

"Based on the information made public, there is no evidence that Amazon Web Services itself was breached," Basica told Healthcare IT News. "Aesto reported that an unauthorized party gained access to a portion of Aesto's infrastructure hosted on AWS. Those are two very different things."

Whose Job Is It, Really?

Think of it like renting an apartment in a secure building. The landlord installs the front door locks and the security cameras in the lobby. But if you leave your own apartment door unlocked, or hand your key to a stranger who calls pretending to be the building manager, that's not a failure of the building's security system. It's a failure of how the tenant used the space they were given.

That's roughly the relationship between AWS and the companies that build on top of it. AWS secures the underlying infrastructure. The healthcare tech companies renting that infrastructure are responsible for their own applications, their access credentials, and how tightly they lock down who can see what.

"The name of the cloud provider is not a security strategy," Basica said. "Neither is a certification or an annual security review."

That line matters because Aesto, according to its own website, holds what it describes as gold standard security certifications. It works with dozens of healthcare providers across multiple EHR platforms. And still, something went wrong badly enough to expose 9.5 million records.

Basica raises questions that remain unanswered. Why could a single point of entry reach information belonging to more than 9.5 million people? Why didn't monitoring systems catch and stop the activity before the data actually left the building, so to speak?

Those questions point to what Basica sees as the real threat: not the existence of vulnerabilities, which are inevitable, but the failure to stop data from being carried out the door once someone gets in.

"The ability to remove large amounts of patient information must be blocked before an intrusion becomes a massive breach," he said.

Cloud breaches almost always start the same mundane way: a stolen password, a compromised access key, a mishandled security token. From there, attackers exploit unpatched software, poorly configured storage, or a weak link in a third-party integration. None of that is unique to the cloud. What the cloud can do, if it's not carefully designed, is multiply the fallout.

"If the environment is not properly designed, the cloud can dramatically increase the number of people affected by a single failure," Basica explained. "Getting in is the first failure."

If a compromised account has broad permissions, an attacker can hop from one database to another, touch multiple storage systems, and reach records belonging to numerous unrelated healthcare clients, all through a single stolen login. Worse, they can use AWS's own tools and interfaces to do it, tools that look completely legitimate to the system because, technically, the credentials say they're allowed to be there.

"This is why encryption alone is not enough," Basica said. "If the stolen credentials are authorized to retrieve and decrypt the information, the system may deliver readable patient records to the attacker because it believes the attacker is an authorized user."

Stopping that requires a handful of hard architectural commitments: security built into the system from the ground up, access limited to what's strictly necessary, healthcare clients kept separated from one another so one company's failure doesn't cascade into everyone else's, and unusual activity flagged and investigated the moment it appears, not weeks later.

"Every healthcare technology company entrusted with patient information must design its systems with the expectation that someone will eventually attempt to get through the first door," Basica said. "The measure of the security system is whether that person can get through the second door, the third door and ultimately reach the patients."

Why It Matters

Here's the part that should keep health system leaders up at night: most patients affected by breaches like these have no idea their information was ever stored by CareCloud or Aesto in the first place. These are business associates, vendors working quietly behind the scenes of the provider a patient actually sees. As Basica put it, "Patients don't necessarily know who has their data."

That anonymity has a cost. When millions of records concentrate inside one vendor's systems, a single point of failure can ripple across dozens of unrelated hospitals, clinics, and health plans. A credit card number can be cancelled and reissued in minutes. A Social Security number, a birth date, a diagnosis history cannot be so easily replaced. And there's a grim compounding effect at work here too: much of this basic identity information has already circulated through earlier breaches. Fresh data doesn't just get stolen. It gets stitched together with old stolen data, making a criminal's profile of any given person more complete, and more dangerous, each time.

That is the uncomfortable truth underneath the headlines. The cloud didn't create this problem. But without disciplined design, limited access, and systems built to catch exfiltration in the moment it happens, the cloud can turn a single mistake into a crisis affecting millions of people who never even knew they were exposed.