Craneware: Data Exfiltration From a US Healthcare Billing Vendor

Craneware, the Edinburgh-headquartered healthcare finance software maker listed on London's AIM market, disclosed on Monday 20 July 2026 that intruders gained unauthorised access to "a subset of its data environment" and exfiltrated a "significant volume" of files, including employee data and a subset of customer and partner records. The disclosure came via a regulatory filing to the London Stock Exchange, making the company's own statement the primary account of the incident. Craneware says the intrusion is contained, that the attackers no longer have a foothold, and that no customer services or internal operations were disrupted. The company has notified the UK Information Commissioner's Office and the US Federal Bureau of Investigation. Critically, no source establishes whether patient-level clinical data was involved, and the company has not said. Craneware's software underpins billing and pricing operations at roughly 2,000 hospitals and health systems and close to 10,000 clinics and retail pharmacies across the United States.

What Happened

Craneware detected unauthorised access to part of its data environment and brought in third-party forensic investigators alongside its internal IT staff, according to the company's filing as reported by The Record, Infosecurity Magazine, Cybersecurity Dive and The Independent. The company states the incident has been contained and that external specialists found no signs of ongoing system compromise.

Beyond that, the disclosure is thin by design or by necessity. The Record notes plainly what the notice does not say: who was responsible, when the attackers first gained access, how long they had it, or whether an extortion demand was made. TechCrunch reported that CEO Keith Neilson did not respond to questions about the incident or about any ransom demand; after publication, chief growth officer Ian Armstrong said the company was still investigating but declined further comment. TechCrunch also noted it was not clear whether Craneware's systems could receive email during the response, which is itself a weak signal about the scope of the containment action.

Craneware is a UK company with a US footprint. It is headquartered in Scotland with US headquarters in Florida, employs around 800 people globally per its website, and was founded in 1999. Its flagship platform, Trisus, includes the Trisus Chargemaster product used to manage the prices hospitals and insurers bill to patients.

What Was Taken

The company's own framing is deliberately two-tiered, and it is worth reading carefully.

First tier: a "significant volume" of file names were viewed and copied out of the network. Infosecurity Magazine, The Record and The Independent all report the file-name phrasing specifically, and Craneware assesses that "a large element of the data involved is non-sensitive or already public regulatory data."

Second tier, and the part that actually matters: Craneware confirmed that "a percentage of Craneware employee data as well as a subset of customer and partner records have been accessed and exfiltrated." That is actual data, not just metadata.

No source provides a record count, a number of affected individuals, or a data volume figure. Accounts do not conflict on this point; the figure simply does not exist yet in any of the reporting. Craneware says it is still determining the exact scope and expects to notify affected organisations and individuals once it has, and is working with advisers to establish whether further disclosure to authorities is required.

The open question is patient data. The Record notes that Craneware did not say whether patient information was among the stolen data, a determination that would decide whether US HIPAA obligations apply. Cybersecurity Insiders makes the same point, that neither Craneware nor Cybersecurity Dive has said whether patient-level clinical data was exposed. For scale context on what the company holds rather than what was taken: TechCrunch reports that when Craneware acquired Florida-based pharmacy software maker Sentry in 2021, it said it gained access to 147 million patient records collected over two decades. That figure describes the company's data estate, not the breach. Do not conflate the two.

One outlier worth flagging: the OTHER-tier piece at greatmaplecircle.com asserts that hackers "exfiltrated a significant volume of customer data, including employee data, customer records, and partner information" and frames patient data as directly at risk. That framing goes further than Craneware's own statement and further than any established outlet's reporting, and should not be treated as confirmed.

Why It Matters

This is a supply-chain exposure story, not a single-victim story. Craneware sits in the revenue-cycle plumbing of American healthcare: chargemaster pricing, reimbursement tracking, 340B and regulatory compliance reporting. Cybersecurity Dive and Cybersecurity Insiders both make the same observation, that the vendor's back-office position is precisely what gives a breach of it downstream reach across more than 2,000 hospitals and nearly 10,000 clinics and pharmacies. Cybersecurity Dive further notes that Craneware lists US trade associations and technology companies including Microsoft and the National Rural Health Association as strategic partners, widening the partner-record blast radius beyond direct customers.

The "mostly file names and public regulatory data" framing deserves scrutiny rather than reassurance. Darren Williams, CEO of anti-data-exfiltration vendor BlackFog, told Infosecurity Magazine that the volume of file names accessed and copied "shows that determined attackers can carry out data exfiltration with relative ease," and that customer and partner record exposure "demonstrates that even incidents framed as low severity can carry real exposure risk." File-name inventories are reconnaissance product: directory structures, client names, project codenames and document titles map an organisation's internal geography and seed convincing follow-on phishing against every named customer.

The incident also lands in a run of healthcare-vendor compromises. The Record notes that in March, software firm CareCloud warned that patient electronic health records may have been leaked. TechCrunch and Cybersecurity Dive both frame Craneware as the latest in a sustained pattern of attacks against companies supplying technology to the US healthcare sector, on the logic that compromising one widely deployed vendor reaches many providers at once. The greatmaplecircle piece additionally references a TriZetto breach affecting over 3.4 million people; that claim appears in no other source here and is offered as attribution only, not as confirmed fact.

The Attack Technique

There is no initial access vector in the public record. Infosecurity Magazine states directly that no information was disclosed about the identity of the intruders or how they gained access. The Record confirms the same gaps around timeline and dwell time. No threat actor has claimed the intrusion in any of the reporting reviewed, no ransomware family has been named, and no extortion demand has been confirmed or denied.

What can be said from the disclosure's shape: this reads as a data-theft-only intrusion rather than a disruptive encryption event. Craneware reports no service disruption and no operational impact, and the containment narrative centres on evicting the attacker rather than on restoring systems. That pattern is consistent with the exfiltration-first extortion model that has dominated healthcare-adjacent intrusions, where the leverage is publication rather than downtime. That is an inference about attacker economics, not a confirmed finding, and it should be held loosely until Craneware or an actor says more.

What Organizations Should Do

If you are a Craneware customer or partner, or you run any healthcare organisation dependent on third-party revenue-cycle software, the following are actionable now.

1. Contact Craneware directly for your own scope determination. The company says it is working to identify affected parties and will notify them. Do not wait passively; open a ticket and ask specifically whether your organisation's records, your staff contacts, or any patient-linked data appear in the exfiltrated set. Note TechCrunch's observation that email reachability may have been affected, so use an out-of-band channel if your first attempt goes unanswered.

2. Treat file-name exposure as a phishing precursor. Brief finance, revenue-cycle and pharmacy staff that attackers may now hold plausible internal document titles and vendor-relationship details. Expect lures referencing real chargemaster files, 340B reports or Trisus workflows. Raise scrutiny on any inbound message invoking Craneware branding or referencing billing-file names.

3. Rotate and audit vendor-linked credentials and integrations. Review API keys, service accounts, SFTP credentials and SSO trusts connecting your environment to Craneware or Trisus. Revoke anything unused, rotate what is active, and pull authentication logs for those identities covering the widest window you retain, since neither the intrusion date nor the dwell time is known.

4. Preserve and hunt across the full log window you have. Because Craneware has not disclosed when the intrusion began, scope hunting by your retention limit rather than by an assumed date. Prioritise anomalous data egress, unusual access to shared file repositories, and off-hours authentication on vendor-associated accounts.

5. Get a legal and compliance determination started on the patient-data question. Whether HIPAA breach-notification duties attach turns on a fact Craneware has not yet published. Involve counsel and your privacy officer now so you are not building the analysis under a notification clock later. UK-exposed entities should track the ICO filing; US entities should track FBI and HHS engagement.

6. Re-examine third-party monitoring for back-office vendors specifically. Security programmes commonly scrutinise clinical and EHR vendors far harder than billing, pricing and compliance-reporting suppliers. This incident, and the CareCloud case The Record cites, argue for extending continuous monitoring, contractual breach-notification SLAs and data-minimisation review to the financial-operations tier of your vendor estate.

7. Assume the disclosure will expand. Initial "largely non-sensitive" assessments in exfiltration cases are frequently revised as forensic review completes. Plan communications and customer-facing messaging against a scenario where the confirmed data set grows.

Sources: Huge Data Breach: Hackers Target Healthcare Tech Firm Craneware (2026) | Hackers stole 'significant' amount of data from tech firm relied on... | Software provider to more than 2,000 US hospitals says hackers stol... | US Hospital Finance Software Provider Craneware Reports Data Theft... | Hackers steal customer data from major hospital software vendor Cy... | Health tech firm Craneware admits “significant volume” of customer... | UK health tech firm Craneware admits customer and staff data stolen... | Craneware Healthcare Data Breach Hits 2,000 Hospitals