Craneware, a healthcare technology firm based in Edinburgh, has confirmed that it suffered a cyber attack resulting in the theft of customer and employee data. The company, which provides software to the US healthcare industry, including thousands of hospitals, clinics, and pharmacies, said it is responding to and investigating the incident.
Details of the Breach
According to Craneware, a significant volume of file names were viewed and exfiltrated during the attack. The company stated that the current assessment indicates a large portion of the data involved is non-sensitive or already public regulatory data. However, a percentage of Craneware employee data, as well as a subset of customer and partner records, have been accessed and exfiltrated.
The incident has been contained and has not disrupted customer services or the company’s operations. Craneware, along with external specialists, found no signs of the attack compromising its systems.
Notification and Investigation
Craneware has notified the Information Commissioner’s Office (ICO) in the UK and the Federal Bureau of Investigations (FBI) in the US. The company is working with advisers to establish the exact nature and scope of the data involved and whether further information needs to be provided to authorities.
Company Background
Craneware makes accounting and billing software for the US healthcare system. It partners with around 2,000 hospitals and health systems and 10,000 clinics and pharmacies through its cloud platform Trisus. The company is listed on London’s Alternative Investment Market (AIM) and employs approximately 800 people globally, according to its website.
Broader Context
Cyber attacks have become a major risk, with several severe and costly incidents affecting British businesses in the past year. Jaguar Land Rover, Marks & Spencer, and Harrods were among the largest firms targeted last year.
