Healthcare technology firm Craneware has confirmed that it has been the victim of a cyberattack. Hackers have compromised customer, employee and partner data.
Craneware, based in Edinburgh, provides accounting and billing software to the US healthcare industry. Its customer base is made up of thousands of hospitals, clinics and pharmacies. It said :
“Investigations so far have established that a significant volume of file names were viewed and exfiltrated. The current assessment is that a large element of the data involved is non-sensitive or already public regulatory data. A percentage of Craneware employee data as well as a subset of customer and partner records have been accessed and exfiltrated.”
The company said that although a significant volume of file names were viewed and exfiltrated, the incident has been contained and has not disrupted customer services or the company’s operations.
Craneware said it has notified the Information Commissioner’s Office (ICO) in the UK and the Federal Bureau of Investigations (FBI) in the US. It is also working with external cybersecurity specialists to establish a clearer picture of the compromised data to understand if it needs to provide further details to authorities.
Shares in Craneware dropped sharply in early trading.
Healthcare technology providers are high value targets for cybercriminals. By attacking the healthcare supply chain criminals gain access to thousands of connected healthcare providers and their data.
People living in Essex and certain London boroughs are still experiencing the fallout from a cyberattack on the pathology specialist Synnovis despite the original attack occurring two years ago.
In 2024, UnitedHealth Group, a US health insurance provider was attacked via an unsecured Citrix portal belonging to software supplier Change Healthcare.
Trevor Dearing , Director of Critical Infrastructure at Illumio , pointed out that the true dangers of an attack like this can extend far beyond the initial damage. Cybercriminals are often playing a long game.
“Even where stolen information appears low risk, employee, customer and partner data can be used to fuel phishing, social engineering and follow-on attacks,” he said. “Employees, customers, and partners should remain cautious of any unsolicited communication or suspicious activity on their networks. “Although the incident was contained and services remain operational, we need to reach a point where containment happens before data is exfiltrated. That's becoming even more critical as frontier AI accelerates every stage of the attack lifecycle.”
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
