Craneware reveals cyber attack with employee and customer data stolen

Craneware PLC has disclosed a cyber security incident in which hackers gained unauthorised access to part of its data environment and stole employee, customer and partner records.

The Edinburgh-based healthcare financial performance software firm said a significant volume of file names were viewed and taken, though its current assessment is that much of the data involved is non-sensitive or already public regulatory information.

A percentage of employee data and a subset of customer and partner records were accessed and removed, the company said.

The incident has been contained and there has been no disruption to customer services or operations. External forensic specialists appointed by the board have confirmed there are no residual indicators of compromise in the company's systems.

Craneware has notified regulators and law enforcement agencies, including the Information Commissioner's Office in the UK and the Federal Bureau of Investigation in the US, reflecting the company's substantial American footprint.

Craneware's software is used by US hospitals and health systems to manage revenue integrity, billing compliance and pharmacy operations through its Trisus cloud platform, making data security a particularly sensitive issue for its customer base.

The company is continuing to assess the precise nature and scope of the data involved and is working with advisers to identify affected parties and prepare notifications, including any further disclosures required by regulators.

Its incident response plan was activated on discovery of the breach, with the internal IT team working alongside retained cyber security providers and the newly appointed external specialists.