Healthcare technology firm Craneware has confirmed it was targeted in a cyber attack that resulted in the theft of customer and employee data. The Edinburgh-based company, which provides software to the US healthcare industry, said hackers accessed and exfiltrated a significant volume of file names, including some sensitive records.
Scope of the Breach
According to the company, the current assessment indicates that a large portion of the data involved is non-sensitive or already public regulatory information. However, a percentage of Craneware employee data, as well as a subset of customer and partner records, were accessed and exfiltrated. The incident has been contained and has not disrupted customer services or the company's operations, nor are there signs of system compromise, according to the business and external specialists brought on board.
Authorities Notified
Craneware has notified the Information Commissioner's Office (ICO) in the UK and the Federal Bureau of Investigations (FBI) in the US. The company is working with advisers to establish the exact nature and scope of the data involved and whether further information needs to be provided to authorities.
Company Background
Craneware makes accounting and billing software sold to the US healthcare system, partnering with around 2,000 hospitals and health systems and 10,000 clinics and pharmacies through its cloud platform Trisus. The business, listed on London's Alternative Investment Market (AIM), is based in Scotland and employs some 800 people globally, according to its website.
Rising Cyber Threat
Cyber attacks have become a major risk for businesses, with several severe and costly incidents affecting British companies in the past year. Jaguar Land Rover, Marks & Spencer, and Harrods were among the biggest firms targeted last year, highlighting the growing threat landscape.
