Week of March 23, 2026: CareCloud discloses patient data breach; FCC bans foreign-made routers

The week of March 23, 2026 brought a material cybersecurity incident disclosure from CareCloud, a sweeping FCC ban on new foreign-made routers, and CISA's addition of three actively exploited vulnerabilities—affecting F5 BIG-IP, Langflow, and Trivy—to its Known Exploited Vulnerabilities catalog. Security teams also tracked a widening TeamPCP supply-chain campaign against open-source packages, a critical NetScaler flaw from Citrix, and a data breach at Dutch football club AFC Ajax that exposed season-ticket and stadium-ban records.

CareCloud Discloses Material Cybersecurity Incident in Patient Portal

CareCloud, Inc. disclosed in a Form 8-K that on March 16, 2026 it experienced a temporary network disruption in its CareCloud Health division, partially affecting one of six electronic health record environments for approximately 8 hours before full restoration that evening. The company engaged a Big Four accounting firm's cyber response team and reported the incident to law enforcement and its cybersecurity carrier. On March 24, 2026, CareCloud determined the incident was material given the sensitivity of potentially affected patient information, though it said the event was not reasonably likely to materially affect its financial condition. (U.S. Securities and Exchange Commission (EDGAR))

FCC Bans Sale of New Foreign-Made Consumer Routers

The US Federal Communications Commission barred all new foreign-manufactured consumer routers from import and sale within the United States, placing them on the FCC's Covered List following a determination by a White House-led interagency group that such devices pose what officials called an "unacceptable risk" to national security and public safety. The restriction applies only to new devices; previously authorized routers already on the market can continue to be sold and used. Manufacturers may still pursue an exemption process, though security experts noted that few consumer-grade routers are assembled domestically in the United States. (Help Net Security)

Citrix Patches Critical NetScaler ADC and Gateway Flaws

Citrix addressed two vulnerabilities in NetScaler ADC and NetScaler Gateway, including CVE-2026-3055, a flaw that could let attackers extract active session tokens from device memory, and CVE-2026-4368, a race condition that could expose one user's session to another. Cloud Software Group said it was not aware of any exploit available for either flaw at the time of disclosure but urged customers to upgrade immediately given the low complexity of potential attacks and the similarity between CVE-2026-3055 and the previously exploited CitrixBleed2 vulnerability. Both flaws affect NetScaler versions 14.1 and 13.1 prior to patched releases. (Help Net Security)

TeamPCP Compromises LiteLLM PyPI Packages in Expanding Supply-Chain Spree

A cybercriminal group tracked as TeamPCP uploaded two compromised versions of BerryAI's LiteLLM library, versions 1.82.7 and 1.82.8, to PyPI on March 24, 2026, embedding a credential stealer and a malware dropper. Because LiteLLM often sits between applications and multiple AI service providers, the tainted packages could expose API keys, environment variables, and other sensitive configuration data. The malicious versions were later removed from PyPI. The compromise followed the same pattern TeamPCP used against Aqua's Trivy scanner on March 19 and CheckMarx's VS Code extensions on March 23. (Help Net Security)

AFC Ajax Discloses Data Breach Exposing Season Tickets, Stadium Bans

Dutch football club AFC Ajax disclosed that an unknown hacker gained access to parts of its IT systems by exploiting exposed APIs and shared access keys in the club's app and website. The breach exposed email addresses for a few hundred people, and names, email addresses, and dates of birth for fewer than 20 individuals subject to a stadium ban. A journalist who was contacted by the hacker alerted Ajax, which said the access could also have allowed tampering with more than 42,000 season tickets and viewing of 538 active stadium bans. The club filed a police report and notified the Dutch Data Protection Authority. (Help Net Security)