Craneware plc (AIM: CRW.L), the Edinburgh-headquartered healthcare financial performance software provider, disclosed on 20 July 2026 that it suffered a cybersecurity incident resulting in unauthorized access to a subset of its data environment.
The company, which supplies billing and revenue-cycle software to roughly 2,000 US hospitals and nearly 10,000 clinics and retail pharmacies, warned the breach could carry significant downstream risk for the American healthcare sector.
Craneware confirmed that a significant volume of file names were viewed and exfiltrated by the attackers, though the company assessed that a large portion of the accessed data is non-sensitive or already public regulatory information.
Critically, a percentage of Craneware employee data, along with a subset of customer and partner records, was also accessed and exfiltrated during the intrusion.
Craneware Data Breach
The company has not yet detailed the specific data types compromised, such as personal identifiers or financial records, and says it is still assessing the precise nature and scope of the affected data.
Craneware activated its incident response plan and appointed external cybersecurity and forensic specialists, working alongside its internal IT team and retained security service providers to investigate.
The company stated the incident has been contained, with no disruption to customer services or operations, and external specialists confirmed no residual indicators of compromise remain in its systems.
Craneware notified relevant regulators and law enforcement, including the UK Information Commissioner’s Office and the US Federal Bureau of Investigation.
According to LSE, working with advisers to identify affected parties and prepare required notifications under applicable data protection obligations, with further updates expected as the investigation progresses.
Security researchers flagged the breach as another example of healthcare’s exposure to third-party vendor risk, since compromising a widely used software supplier can offer attackers a pathway into numerous downstream hospital systems.
Craneware’s flagship Trisus Chargemaster platform, rated Best in KLAS, underpins pricing and billing operations across a substantial share of the US hospital market, amplifying the potential blast radius of any data exposure.
Notably, Craneware’s 2021 acquisition of Florida-based Sentry had previously given it access to roughly 147 million medical records accumulated over two decades, underscoring the scale of sensitive data the company handles even though this incident’s exposure is currently described as more limited.
Craneware has operated for over 25 years as a leader in healthcare financial and operational transformation, and its Trisus cloud ecosystem unifies data, revenue intelligence, and analytics for healthcare organizations as a Microsoft partner.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
, the Edinburgh-headquartered healthcare financial performance software provider, disclosed on 20 July 2026 that it suffered a cybersecurity incident resulting in unauthorized access to a subset of its data environment.){kind=link}