Edinburgh firm Craneware hit by cyber security attack

Shares in a Scottish technology company which provides revenue management tools to the US healthcare market plunged today after it informed the stock market that it has been hit by a cyber-attack.

Edinburgh -based Craneware said it has identified and is responding to a cyber security incident involving the “unauthorised access to a subset of its data environment”, with investigations so far revealing that a “significant volume of file names was viewed and exfiltrated”.

“The current assessment is that a large element of the data involved is non-sensitive or already public regulatory data,” the company declared in a statement.

“A percentage of Craneware employee data as well as a subset of customer and partner records have been accessed and exfiltrated.

“The company is continuing to assess the precise nature and scope of all the data involved and [it] is working with its advisers to identify affected parties and prepare appropriate notifications, including any required further notifications to relevant authorities, in each case in accordance with applicable regulatory obligations.

“The company will update the market as appropriate.”

Craneware is led by long-term chief executive Keith Neilson, who co-founded the company in 1999. The business provides revenue management software to around 2,000 hospitals across the US and employs 200 people in the UK, mainly as product developers and engineers. It has a further 600 people on the payroll across the Atlantic following the £283 million acquisition of Florida-based Sentry in 2021.

Earlier this month, Craneware said it expects its financial performance for the year to June 30 to be below market expectations, reflecting the timing of 340B activity and the deferral of a small number of significant enterprise contracts that are now expected to contribute during the financial year. 340B refers to a US federal government programme that requires drug manufacturers to provide outpatient prescription drugs at significant discounts.

Craneware expects to report revenue in the region of $205 million to $208m and adjusted earnings before interest, tax, depreciation and amortisation for the 2026 financial year, both broadly in line with 2025.

Mr Neilson said at the time: "Naturally we are disappointed not to have delivered the growth that we expected in FY26. While the short-term complexity in the pharmacy market has impacted the year, the long-term opportunity remains intact.

“This reinforces our strategy of expanding beyond software and analytics into technology-enabled operational transformation that helps customers realise the opportunities identified by the group's platform, and this is a continuing area of focus for our innovation efforts. We believe this strengthens both our customer relationships and our long-term growth opportunity, as healthcare providers increasingly seek trusted partners capable of combining data, workflow automation and operational expertise to deliver measurable financial outcomes. Our role is evolving from helping customers identify opportunity to helping them realise it.

“We continue to benefit from high levels of customer retention and cash generation, providing us with a strong financial foundation to execute on our strategy.”

Craneware said this morning that it has activated its incident response plan and has appointed external cyber security and forensic specialists to investigate the attack alongside its IT team and its retained cyber security service providers.

“The incident has been contained and there has been no disruption to customer services or to the company’s operations,” it said. “The external specialists have confirmed that there are no residual indicators of compromise arising from the cyber security incident in the company’s systems.

“The company has notified the relevant regulators and law enforcement agencies, including the Information Commissioner’s Office in the UK and Federal Bureau of Investigations in the US.”

Shares in Craneware dropped by nearly 9% in early trading before regaining some of the losses, closing down 5.77% or 70p at 1,144p.