Craneware Confirms Data Breach Affecting US Hospitals

Healthcare technology company Craneware has confirmed a data breach following unauthorized access to a portion of its systems. The Scotland-based firm disclosed that attackers stole a "significant volume" of data after identifying the intrusion on July 20 Source.

Craneware specializes in accounting and billing software for healthcare providers, supporting more than 2,000 US hospitals and nearly 10,000 clinics and pharmacies.

Details of the Breach

The company's investigation revealed that a "significant volume of file names were viewed and exfiltrated." While Craneware stated that most of the exfiltrated data was non-sensitive and publicly available regulatory information, some employee, customer, and partner records were also accessed and taken.

At present, the precise nature and full scope of the compromised data are still being assessed. Craneware has not detailed the type of attack or the total amount of data involved.

Response and Notifications

Craneware has notified relevant authorities in both the UK and the US, including the FBI. The company also reported the incident to the Information Commissioner's Office (ICO) in the UK.

According to Craneware, the cybersecurity incident has been contained, and operations have not been disrupted. "There has been no disruption to customer services or to the company's operations," the company stated Source. External specialists have confirmed no residual indicators of compromise remain within their systems.

Implications for Healthcare Sector

The healthcare sector remains a prime target for cyberattacks due to the sensitive and valuable nature of patient data. Attackers often seek personal details, medical histories, and insurance information, which are highly prized on the dark web.

Even non-sensitive employee or partner data, if exfiltrated, can be used by malicious actors for tailored attacks or to gain deeper access into healthcare organizations. This incident serves as a reminder that robust cybersecurity measures and vendor risk management are crucial for any business operating within or alongside the healthcare ecosystem.

Craneware is continuing to work with its advisors to identify affected parties and prepare appropriate notifications in line with regulatory obligations.