A Healthcare Billing Company Used By Thousands Of US Hospitals Just Got Hacked

Craneware, a UK-based healthcare billing software maker, confirmed hackers stole a "significant volume" of customer data from its systems. Given how many hospitals, clinics, and pharmacies actually depend on this company's software to function, this breach deserves a lot more attention than a typical corporate hack disclosure.

Craneware disclosed the breach on Monday, filing a statement with the London Stock Exchange. According to the company, hackers appear to have been expelled from its systems, but the investigation into the full scope of the breach is still ongoing.

Here's the vague part that should genuinely concern anyone whose healthcare provider uses this software: Craneware hasn't specified exactly what kinds of data were taken. The company only said that a "percentage" of employee data, customer data, and partner records had been exfiltrated language that's frustratingly non-specific for a breach involving a company that handles this much sensitive information.

Craneware CEO Keith Neilson didn't respond to TechCrunch's questions about the incident, or whether the hackers have made contact with any demands, like a ransom. After publication, the company's chief growth officer Ian Armstrong confirmed the investigation was ongoing but declined to add further comment. It's also currently unclear whether the company's systems can even receive email while the attack response is underway a detail that hints at just how disruptive this breach has actually been to Craneware's internal operations.

Craneware's flagship accounting and billing software is used by thousands of clinics, hospitals, and pharmacies across the United States. This isn't a niche vendor it's core infrastructure that a huge number of American healthcare providers rely on to actually bill patients for services.

And billing software, despite sounding administratively boring, sits on an enormous amount of sensitive data. Craneware handles large volumes of medical records and patient data on behalf of its customers. When the company acquired Florida-based pharmacy software maker Sentry back in 2021, Craneware said it gained access to 147 million patient records that Sentry had collected over two decades. That's the scale of data potentially connected to Craneware's systems not necessarily all directly exposed in this specific breach, but illustrative of just how much sensitive health information flows through a company like this.

Why hackers keep targeting healthcare billing and data infrastructure specifically

This is the part worth understanding clearly: hackers aren't just targeting hospitals directly anymore. They're targeting the software companies that supply billing, records, and administrative tools to those hospitals because compromising one vendor gives them access to patient data spanning potentially thousands of downstream healthcare providers at once, rather than having to breach each hospital individually.

Once they have that data, the attackers can extort the company directly, threatening to publicly release sensitive patient medical and health information unless demands are met. It's a genuinely efficient attack strategy from the hackers' perspective one successful breach against a shared vendor can yield exponentially more sensitive records than breaching any single hospital or clinic on its own.

Craneware is just the latest entry in a genuinely alarming pattern

This breach doesn't exist in isolation it's part of a clear, escalating pattern of healthcare tech vendors getting hit over the past year.

In March, healthcare revenue tech firm TriZetto confirmed hackers stole more than 3.4 million people's personal and health data from its systems. That same month, medical data storage giant CareCloud reported a breach affecting one of its stores of patients' electronic health records though the company still hasn't disclosed how much data was actually taken.

Last July, medical billing company Episource began notifying at least 5.4 million people that their health information had been stolen.

And looming over all of these is the breach that set the grim benchmark for just how bad this can get: in 2024, a Russian-speaking ransomware gang hacked UnitedHealth-owned Change Healthcare, stealing the medical and patient records of at least 192 million people a breach the company itself conceded affected "a substantial proportion of people in America."

Put these incidents together TriZetto, CareCloud, Episource, Change Healthcare, and now Craneware and you get a clear picture of a healthcare technology supply chain that keeps proving vulnerable to exactly the same attack strategy, repeatedly, over more than a year. Attackers have clearly identified that healthcare billing and data infrastructure vendors represent high-value, comparatively soft targets, given how much sensitive data concentrates in these systems and how many downstream providers depend on them.

For patients, the uncomfortable reality is that your healthcare data's security often depends less on your specific hospital or pharmacy's own security practices, and more on the security of software vendors you've probably never heard of, sitting several layers back in the healthcare system's technology stack. Craneware being used by "thousands" of hospitals, clinics, and pharmacies means the potential blast radius here, once the investigation's actual findings come out, could be substantial.

Craneware says its investigation is ongoing, and the company hasn't yet disclosed the actual scope of what data was taken, how many people might be affected, or whether hackers have made contact with ransom demands. Given the pattern established by TriZetto, CareCloud, Episource, and Change Healthcare, the concerning likelihood is that the initial disclosure vague as it currently is will eventually be followed by a much larger, more specific accounting of affected patient records, once the investigation concludes and regulatory disclosure requirements force more detail into the open.