Craneware has confirmed that employee information and a subset of customer and partner records were stolen after attackers gained unauthorized access to part of the healthcare technology company’s data environment. The incident has been contained, customer services remain operational, and the FBI and UK authorities have been notified.
The Edinburgh-based company disclosed the cybersecurity incident on July 20, 2026. Craneware provides financial, accounting and billing technology to more than 2,000 US hospitals and supports nearly 10,000 clinics and retail pharmacies, making the breach significant for the wider American healthcare supply chain.
What Craneware discovered
An ongoing forensic investigation found that attackers viewed and exfiltrated a “significant volume” of file names. Craneware said most of this material appears to involve non-sensitive information, including regulatory data that was already publicly available.
However, the investigation also confirmed that a percentage of Craneware employee data and a subset of customer and business-partner records were accessed and removed. The company has not specified the individual data fields involved or disclosed how many people or organizations may be affected.
Craneware’s official cybersecurity incident notice says external cybersecurity and forensic specialists are working with its internal teams to determine the precise nature and scope of the compromised information.
Were hospital or patient records stolen?
There is currently no confirmation that patient medical records, insurance details, payment information or hospital databases were taken. Craneware has only identified affected employee information and certain customer and partner records so far.
The company has not named a suspected attacker, explained how its systems were accessed or said whether ransomware or an extortion demand was involved. Claims that thousands of hospitals were directly breached would therefore go beyond the confirmed information.
Craneware’s large US healthcare presence explains why the incident is attracting attention, but using the company’s software does not automatically mean every connected hospital, clinic or pharmacy had information exposed.
Read More
Services continued without disruption
Craneware said the incident has been contained and caused no disruption to customer services or its business operations. External specialists reportedly found no remaining indicators of compromise associated with the attack in the company’s systems.
This differs from some healthcare cyberattacks that immediately interrupt essential technology. A previous MediMap cyberattack affecting aged-care services forced providers to rely on paper medication records while the affected systems were investigated.
Continued service does not remove the need for a detailed review. Data theft may remain operationally invisible while still creating privacy, regulatory and security risks for affected people and organizations.
FBI and UK regulator notified
Craneware has informed relevant regulators and law-enforcement agencies, including the US Federal Bureau of Investigation and the UK Information Commissioner’s Office. These notifications form part of the company’s legal and regulatory response.
The company is working with advisers to identify affected parties and prepare direct notifications where required. Additional reports may be submitted to authorities as investigators establish what information was taken and which jurisdictions are involved.
What employees and customers should watch for
Even information initially considered non-sensitive can help criminals create convincing phishing messages. File names, professional details and known business relationships may allow a fraudulent email to appear familiar or legitimate.
Other incidents demonstrate why the exact categories of compromised information matter. The Carnival data breach affecting nearly six million customers involved clearly identified personal information, while Craneware has not yet provided a comparable breakdown of the records taken.
Craneware employees, customers and partners should treat unexpected password-reset requests, payment instructions, document invitations and urgent support messages with caution. Any request should be verified through a familiar telephone number or an independently accessed company portal.
There is no confirmed evidence that passwords or financial credentials were exposed, so precautionary password changes should not be presented as an official breach requirement. Anyone receiving a direct notification from Craneware should follow the specific guidance provided.
What remains unknown
The number of affected individuals, exact categories of stolen information and duration of unauthorized access remain undisclosed. Craneware has not provided a date for completing its investigation.
A serious data-exfiltration incident has been confirmed, but its full impact remains under assessment. Further notifications should clarify whether sensitive personal information was involved and whether affected customers need to take additional protective measures.
Make Swikblog your go-to source on Google for reliable updates, smart insights, and daily trends.
