Craneware discloses cyber security breach affecting employee and customer data

Craneware PLC, an Edinburgh-based provider of healthcare financial performance software, disclosed that hackers gained unauthorized access to a portion of its data environment and removed employee, customer and partner records.

The company said investigators have so far determined that a large number of file names were viewed and taken from its systems, though its current assessment indicates that much of the exposed material is non-sensitive or consists of information already publicly available through regulatory channels. A portion of Craneware’s employee data, along with a subset of customer and partner records, was accessed and removed during the intrusion.

Craneware said the breach has been contained and that neither its operations nor the services it provides to customers were disrupted as a result. External forensic experts brought in by the company’s board have since confirmed that no indicators of the compromise remain within Craneware’s systems.

The company has alerted authorities on both sides of the Atlantic, notifying the UK’s Information Commissioner’s Office and the FBI in the United States. The involvement of U.S. law enforcement reflects the scale of Craneware’s business in the American market, where its software is used by hospitals and health systems to manage revenue integrity, billing compliance and pharmacy operations through its Trisus cloud platform.

Craneware activated its incident response plan upon discovering the breach, deploying its internal IT staff alongside its existing cyber security vendors and the newly retained external forensic team. The company said it is still working to determine the full scope of the data involved and is coordinating with advisers to identify individuals and organizations affected, with plans to issue further notifications as required under applicable regulations.

The company said it will provide additional updates as its investigation progresses.

Craneware has operated in the healthcare financial and operational transformation sector for more than 25 years. Its Trisus cloud ecosystem combines data, revenue intelligence, margin intelligence and analytics tools designed to help healthcare organizations manage their finances and operations, and the company holds a partnership with Microsoft.