World news and discussion on TalkFuse.
Hackers stole ‘significant’ amount of data from tech firm relied on by thousands of US hospitals and pharmacies
Craneware, a UK-based healthcare billing software provider used by thousands of hospitals, clinics and pharmacies across the United States, has confirmed that hackers stole a "significant volume" of data from its systems. The company says the attackers have now been removed from its network, though its investigation is still ongoing, and it has yet to disclose exactly what type of data was compromised. The breach matters because Craneware's billing software gives it access to vast amounts of sensitive patient and medical records, making it an attractive target for extortion.
The company disclosed the incident in a statement to the London Stock Exchange on Monday, saying a "percentage" of employee, customer and partner data had been exfiltrated, without giving further detail. Craneware gained access to 147 million patient records dating back two decades through its 2021 acquisition of pharmacy software firm Sentry, though it is unclear if this data was affected. It is the latest in a string of breaches at healthcare technology suppliers, following incidents at TriZetto, CareCloud and Episource, and comes after the 2024 Change Healthcare hack, in which a Russian-speaking ransomware gang stole records belonging to at least 192 million people.
In short
- Craneware confirms hackers stole significant data from its systems.
- UK firm's software is used by thousands of US healthcare providers.
- Latest in a series of recent healthcare tech data breaches.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Healthcare's repeated, massive data breaches—affecting 192 million people at Change Healthcare and now thousands of hospitals through Craneware—demonstrate that market-based incentives alone have proven insufficient to ensure adequate protection of sensitive patient information. Healthcare infrastructure is too critical to accept vulnerability of this magnitude. Stronger mandatory security standards, independent audits, and meaningful financial penalties are necessary to force companies to genuinely prioritise patient data protection over cost savings.
The case against
Sophisticated cyberattacks will inevitably succeed regardless of security measures because attackers continuously develop new techniques and target valuable systems persistently. Imposing stricter regulations will not prevent determined breaches but will burden healthcare systems with compliance costs that divert resources from patient care and innovation. A more realistic approach acknowledges this reality and instead focuses on rapid breach detection, swift incident response, transparent accountability, and liability frameworks that incentivise protection without pursuing impossible perfect security.
Explained simply
Craneware is a software company based in the UK that helps thousands of American hospitals, clinics and pharmacies manage their billing. Hackers have stolen what the company describes as a "significant volume" of data from its systems, though Craneware has not yet said exactly what information was taken.
Craneware's software handles sensitive patient information and medical records, which makes the company an attractive target for criminals who want to steal or extort the data. The breach is particularly concerning because through a 2021 acquisition, Craneware has access to patient records dating back two decades, potentially affecting millions of people.
Breaches of healthcare technology suppliers have become increasingly common in recent years. Other major healthcare firms have suffered similar attacks, and in 2024 a Russian-linked ransomware gang stole records from at least 192 million people in one of the largest healthcare breaches on record.
Americas Business Companies Cybersecurity Health Medicine Software Technology World