Craneware breach: medical data of thousands of US hospitals at risk

Craneware, an Edinburgh-based company that develops medical billing software, has said it fell victim to a cyberattack in which the intruders stole a “significant amount” of data. The disclosure came in a filing the company submitted to the London Stock Exchange.

According to Craneware, the hackers appear to have been forced out of its systems, though the investigation into the incident is ongoing. The company did not specify exactly which data was stolen, noting only that the breach affected “a percentage” of information about employees, customers and partners.

Why it matters

Craneware's flagship accounting and billing software is used by thousands of clinics, hospitals and pharmacies across the United States. The company helps medical institutions bill patients for services and therefore processes vast troves of medical records and patients' personal data on behalf of its clients.

The scale of the potential damage can be gauged from a single deal: in 2021, by acquiring Florida-based pharmacy software developer Sentry, Craneware gained access to 147 million patient records amassed over two decades.

The company's chief executive, Keith Neilson, had not responded to TechCrunch's questions by the time of publication — including whether the hackers had made any ransom demands. It is not even clear whether Craneware's systems are able to receive email amid the ongoing attack.

Part of a troubling trend

The Craneware breach is only the latest in a string of incidents in which hackers have targeted technology providers to the US healthcare system. By compromising software used by numerous medical institutions, attackers gain access to enormous volumes of patient health data and can extort the companies with the threat of publishing what they have stolen.

In March, TriZetto confirmed the theft of data belonging to more than 3.4 million people, and around the same time CareCloud reported a breach of electronic medical records. Last July, billing company Episource began notifying that the data of at least 5.4 million people had been stolen.

The largest medical data breach in US history took place in 2024: a Russian-speaking ransomware group hacked Change Healthcare, a company owned by UnitedHealth, and stole the records of at least 192 million people — by the company's own admission, “a substantial proportion of people in America” were affected.

Source: TechCrunch