Health tech firm Craneware says customer and staff data stolen in cyber attack

Healthcare technology firm Craneware said it has been hit by a cyber attack, with hackers stealing some customer and employee data.

The Edinburgh-based company provides software to the US healthcare industry, including thousands of hospitals, clinics and pharmacies.

Craneware, which is listed on London’s Alternative Investment Market (AIM), said it was responding to and investigating a cyber incident through which a significant volume of file names were viewed and exfiltrated.

“The current assessment is that a large element of the data involved is non-sensitive or already public regulatory data,” according to the company.

“A percentage of Craneware employee data, as well as a subset of customer and partner records, have been accessed and exfiltrated.”

The incident has been contained and has not disrupted customer services or the company’s operations, nor are there any signs of it compromising its systems, according to the business and external specialists brought on board.

Craneware said it has notified the Information Commissioner’s Office (ICO) in the UK and the Federal Bureau of Investigations (FBI) in the US.

It was also working with advisers to establish the exact nature of the scope of the data involved in the attack and whether it needs to give further information to authorities.

Craneware makes accounting and billing software, which it sells to the US healthcare system, partnering with around 2,000 hospitals and health systems and 10,000 clinics and pharmacies through its cloud platform Trisus.

The business is based in Scotland and employs some 800 people globally, according to its website.

Cyber attacks have become a major risk, and a handful of severe and costly incidents have affected British businesses in the past year.

Jaguar Land Rover, Marks & Spencer and Harrods were some of the biggest firms to be targeted last year.