Craneware Cyberattack Exposes Employee and US Healthcare Customer Data

Craneware plc, a UK-based provider of healthcare financial performance software, has disclosed that it experienced a cyberattack in which an unauthorized party accessed and extracted data from a portion of its systems.

The company revealed that the incident involved employee information and records related to certain customers and partners, including organizations in the US healthcare sector.

Craneware Cyberattack Exposes Employee Data

In a regulatory announcement published on July 20, 2026, Craneware stated that it identified the intrusion and activated its incident response plan.

The board appointed external cybersecurity and digital forensics specialists to investigate its internal IT staff and security service providers. At this time, the organization has not attributed the attack to a specific threat actor, ransomware operation, or intrusion method.

Craneware assured that the incident has been contained and that customer services and broader business operations remain unaffected. External investigators also found no remaining indicators of compromise within the company’s systems.

However, this confirmation does not resolve the crucial issue of data exposure; investigators are still working to determine exactly which files and records were accessed, copied, or removed.

According to the company’s preliminary assessment, the attackers viewed and exfiltrated a significant volume of file names.

Craneware noted that much of the affected information appears to consist of non-sensitive material or regulatory data that was already publicly available. Nonetheless, it confirmed that some employee data and a subset of customer and partner records were included in the exfiltrated data.

This disclosure is particularly significant because Craneware supports healthcare organizations through its Trisus cloud ecosystem and related revenue-cycle, pricing, financial, and operational tools.

Customers use the platform to manage healthcare financial performance and operational workflows. While Craneware did not confirm whether the accessed customer records included protected health information, patient data, credentials, financial records, or other sensitive information, the potential exposure of data connected to US healthcare entities raises compliance and notification concerns.

Craneware has notified regulators and law enforcement agencies, including the UK Information Commissioner’s Office and the US Federal Bureau of Investigation.

The company stated that it is working with advisors to identify affected individuals and organizations. It will issue notifications as required under applicable legal and regulatory obligations.

For affected healthcare customers, this incident underscores the third-party risk associated with vendors that process or store critical financial and operational information.

Organizations using Craneware services should closely monitor vendor communications, review access logs and integrations associated with the platform, and prepare for potential credential resets, phishing attempts, or targeted social engineering based on information obtained during the breach.

The company did not provide a timeline for the initial access, the discovery date, the number of affected individuals or organizations, or the volume of employee and customer data involved.

Additionally, it has not indicated whether the attackers demanded payment or published stolen files. Craneware noted that its investigation is ongoing and that it will provide market updates as necessary.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.