Craneware plc Reports Cyber Security Incident Following Unauthorised Data Access

Craneware plc (AIM: CRW.L), a healthcare financial performance solutions provider, has identified and is responding to a cyber security incident involving unauthorised access to a subset of its data environment. The company announced on 20 July 2026 that external cyber security and forensic specialists have been appointed and investigations are ongoing. Although customer services and operations have not been disrupted, a significant volume of file names were viewed and exfiltrated, with employee data and some customer and partner records accessed.

Craneware plc identified a cyber security incident involving unauthorised access to a subset of its data environment and has disclosed the matter via regulatory announcement on 20 July 2026. The company's Board immediately activated its incident response plan upon discovery of the incident. Investigations have established that a significant volume of file names were viewed and exfiltrated from the company's systems. The announcement states that the current assessment indicates a large element of the data involved is non-sensitive or already public regulatory data, suggesting that whilst unauthorised access occurred, not all exfiltrated material may carry the same level of sensitivity or confidentiality concern.

Beyond the non-sensitive and public regulatory data accessed, Craneware confirmed that a percentage of employee data as well as a subset of customer and partner records were also accessed and exfiltrated during the incident. The company is continuing to assess the precise nature and scope of all data involved as investigations proceed. This dual exposure—involving both internal employee information and external customer and partner data—presents a more complex remediation and notification scenario than would a breach limited to a single data category. The distinction between sensitive and non-sensitive data will likely inform the scope and urgency of notifications required under applicable data protection and regulatory frameworks.

Upon identifying the cyber security incident, Craneware's Board immediately activated the company's incident response plan, demonstrating a pre-existing framework for managing such situations. As part of this response, the company appointed external cyber security and forensic specialists to lead and support the investigation. These external specialists are working alongside Craneware's internal IT team and the company's retained cyber security service providers. The multi-layered investigation structure—combining external expertise with internal operational knowledge and existing security partnerships—reflects industry best practice for responding to significant cyber incidents and helps to ensure both forensic integrity and operational continuity.

The involvement of external cyber security and forensic specialists brings independence and specialist expertise that may be necessary to fully understand the scope of the incident, identify the method of access, and assess any residual security vulnerabilities. These specialists have already contributed materially to the investigation, confirming that there are no residual indicators of compromise arising from the cyber security incident in the company's systems. This early assurance, whilst not eliminating the seriousness of the breach itself, provides some reassurance to stakeholders that the company's systems have been secured and that further unauthorised access is unlikely. However, the investigation remains ongoing, and the company's full assessment of the incident continues.

Craneware announced that the cyber security incident has been contained and that there has been no disruption to customer services or to the company's operations. This statement is significant for a healthcare technology provider, as service interruptions in the healthcare sector can have material consequences for clients and ultimately for patient care workflows. The fact that Craneware's operations have continued uninterrupted suggests either that the unauthorised access was limited to specific data repositories rather than operational systems, or that the incident was identified and contained swiftly enough to prevent operational systems from being compromised or affected.

Reinforcing the position on system security, external cyber security specialists have confirmed that there are no residual indicators of compromise arising from the cyber security incident in the company's systems. This confirmation is important because it indicates that the breach appears to have been limited in method—likely unauthorised access to data at rest rather than deployment of persistent malware or backdoors that might allow continuing unauthorised access. For Craneware's customers, many of whom operate in regulated healthcare environments, this assurance operational continuity and system integrity will be material to their confidence in continuing to rely on the company's cloud ecosystem solutions, including Trisus®, the company's flagship cloud platform.

Craneware has notified the relevant regulators and law enforcement agencies in response to the cyber security incident. Specifically, the company has informed the Information Commissioner's Office (ICO) in the UK and the Federal Bureau of Investigations (FBI) in the US. The involvement of both UK and US authorities reflects the likely geographic scope of data affected—encompassing both UK-based operations and US-based customers or partners. This dual notification also indicates that Craneware operates across both jurisdictions and that the data affected may be subject to multiple legal and regulatory frameworks governing data protection and breach notification.

The notification to the Information Commissioner's Office is required under UK data protection law, specifically the General Data Protection Regulation as retained in UK law following Brexit. The FBI notification suggests that either US customer data or US-hosted systems were affected, or that the company wished to proactively alert US law enforcement to the incident for investigation and threat intelligence purposes. The company states it is working with its advisers to identify affected parties and prepare appropriate notifications, including any required further notifications to relevant authorities, in accordance with applicable regulatory obligations. This suggests the company recognises its obligations under various data protection regimes and is taking steps to comply with mandatory breach notification requirements.

The cyber security incident involved access to and exfiltration of data across three categories: Craneware employee data, customer records, and partner records. The announcement specifies that "a percentage of Craneware employee data as well as a subset of customer and partner records have been accessed and exfiltrated." The use of "percentage" and "subset" suggests that the breach did not affect all employees, customers, or partners uniformly, but rather targeted or affected specific individuals or organisations within these categories. The distinction between these three data categories is important because each category may be subject to different notification obligations and may trigger different regulatory responses.

Employee data breaches may trigger obligations under employment law and data protection regulations in multiple jurisdictions where Craneware employees are located. Customer data breaches in the healthcare technology sector may trigger notification obligations under healthcare privacy laws as well as general data protection frameworks. Partner data breaches may involve contractual notification obligations as well as regulatory ones. The company has noted that a large element of the data accessed is non-sensitive or already public regulatory data, which may limit the severity of some notification obligations, particularly for customer and partner records that may include regulatory filings or other publicly available information. However, the exfiltration of any employee personal data or sensitive customer or partner information will likely require affected individuals and organisations to be notified in accordance with applicable law.

Craneware plc is a leader in healthcare financial and operational transformation, delivering technologies that drive measurable impact across the healthcare sector. The company has operated for over 25 years and is listed on the AIM market under the ticker CRW.L. Craneware's Trisus® cloud ecosystem unifies data, revenue intelligence, margin intelligence, and advanced analytics, enabling healthcare organisations to optimise performance, improve financial sustainability, and drive strategic growth. The company is a trusted Microsoft partner and provides solutions including the Best in KLAS Trisus Chargemaster, which simplifies the complexities of healthcare finance and operations.

The nature of Craneware's business—providing cloud-based financial and operational solutions to healthcare organisations—means that the company handles sensitive healthcare financial data on behalf of its customers. Healthcare organisations rely on Craneware's cloud ecosystem to manage critical financial workflows, revenue cycles, and operational analytics. A cyber security incident affecting Craneware's data environment therefore has potential implications not only for Craneware itself but also for the healthcare organisations that depend on the company's solutions. The company's positioning as a strategic partner rather than just a technology provider underscores the trust that healthcare organisations place in Craneware's ability to protect their data and maintain service continuity. This announcement will likely prompt Craneware's customers to reassess their confidence in the company's cyber security posture and data protection practices.

The announcement states that the company's current assessment is that a large element of the data involved in the cyber security incident is non-sensitive or already public regulatory data. This assessment is significant because it suggests that whilst a large volume of file names were viewed and exfiltrated, much of this data may not carry the same confidentiality or sensitivity concerns as truly confidential business information or personal data. Healthcare regulatory data—including information filed with regulatory bodies or publicly available compliance documentation—may have already been disclosed in regulatory filings and therefore may not pose the same reputational or competitive risk as proprietary business information.

However, the announcement also makes clear that this assessment is not yet final and complete. The company states it is continuing to assess the precise nature and scope of all data involved. This ongoing assessment reflects the reality that forensic analysis of a cyber security incident, particularly one involving a large volume of exfiltrated files, can take considerable time to complete comprehensively. The distinction between sensitive and non-sensitive data will likely become clearer as the investigation progresses, and this may in turn inform the scope of notifications required and the overall severity of the incident from a regulatory and reputational perspective. Investors may be watching for updates on this assessment as it progresses.

Craneware's announcement makes clear that the investigation into the cyber security incident remains ongoing. The company states that external specialists have confirmed there are no residual indicators of compromise in company systems, yet the precise nature and scope of all data involved is still being assessed. This ongoing investigation is being conducted by external cyber security and forensic specialists, Craneware's internal IT team, and the company's retained cyber security service providers, working in coordination. The multi-layered investigation approach reflects the complexity of the incident and the need for both external expertise and internal operational knowledge to fully understand what occurred and what data was affected.

Craneware has committed to updating the market as appropriate. This statement indicates that the company recognises its obligations to keep shareholders and other stakeholders informed of material developments as the investigation progresses. Future updates may include confirmation of the final scope of data affected, details of any regulatory actions or investigations initiated by the authorities notified, details of affected individuals and organisations requiring notification under applicable law, and any material financial or operational impacts resulting from the incident. Investors should monitor the company's announcements and regulatory filings for further developments as the investigation concludes and the company completes its assessment of the incident's scope and implications.

The cyber security incident at Craneware raises important questions data protection and regulatory compliance in the healthcare technology sector. Healthcare organisations that use Craneware's solutions to manage sensitive financial and operational data will likely scrutinise the company's responses to this incident and may seek additional assurances data protection measures and incident response capabilities. The involvement of external cyber security and forensic specialists and the notification to regulators including the ICO and FBI indicates that Craneware is taking the incident seriously and engaging with formal legal and regulatory frameworks governing data breach response.

From a regulatory perspective, the incident will likely trigger investigations by the Information Commissioner's Office and potentially by other data protection authorities in jurisdictions where affected individuals are located. Such investigations may result in findings regarding the adequacy of Craneware's data protection measures and controls, and may lead to regulatory action or recommendations. The company's compliance with mandatory breach notification timelines and requirements will be assessed by these authorities. For Craneware's customers in regulated healthcare sectors, the incident may trigger their own regulatory reporting obligations and may prompt them to conduct their own assessments of their vendor management and data protection controls. The reputational and business implications of the incident will likely extend beyond the direct costs of notification and remediation.

This article is provided for general information purposes only and does not constitute investment advice. The information contained herein is based on a regulatory announcement issued by Craneware plc and should not be relied upon as a complete or fully accurate representation of the facts surrounding the cyber security incident described. Investors should seek independent financial and legal advice before making any investment decisions, should conduct their own due diligence into the company and the incident, and should consider the risks associated with investing in companies that have experienced cyber security breaches. The company's ability to manage the incident, satisfy regulatory obligations, and maintain customer confidence will be important factors for investors to monitor.