Craneware, a UK-based healthcare billing software provider used by thousands of hospitals, clinics and pharmacies across the United States, has confirmed that hackers stole a "significant volume" of data from its systems. The company says the attackers have now been removed from its network, though its investigation is still ongoing, and it has yet to disclose exactly what type of data was compromised. The breach matters because Craneware's billing software gives it access to vast amounts of sensitive patient and medical records, making it an attractive target for extortion.

The company disclosed the incident in a statement to the London Stock Exchange on Monday, saying a "percentage" of employee, customer and partner data had been exfiltrated, without giving further detail. Craneware gained access to 147 million patient records dating back two decades through its 2021 acquisition of pharmacy software firm Sentry, though it is unclear if this data was affected. It is the latest in a string of breaches at healthcare technology suppliers, following incidents at TriZetto, CareCloud and Episource, and comes after the 2024 Change Healthcare hack, in which a Russian-speaking ransomware gang stole records belonging to at least 192 million people.