Craneware, a London-listed company that makes billing software for US medical facilities, announced the cyberattack on July 20, 2026. In a statement, a company spokesperson said, "Hackers stole a significant volume of data."
The company is still investigating the breach. It is not yet known whether the attackers made any ransom demands or exactly what patient information was taken. Through its 2021 purchase of Florida-based Sentry, Craneware obtained the ability to view roughly 147 million patient records, though whether those were part of the breach remains uncertain.
The Craneware incident highlights the dangers inherent in centralizing large volumes of data. Such incidents often lead to identity theft, insurance fraud, and medical identity theft, and they highlight how deeply interconnected billing and records systems make healthcare organizations a prime target for cybercriminals.
Get the market news that matters in a five-minute read with Market Briefs, our free daily newsletter
Because healthcare organizations depend on external vendors such as Craneware, data is shared through intricate networks, meaning one compromise can cascade through many entities. Recent events underscore this vulnerability: the Change Healthcare attack alone disrupted prescription processing and claims submissions nationwide, affecting nearly half the US population.
Such breaches can have devastating personal consequences. Stolen medical information can be used to file fake insurance claims, obtain prescription drugs, or even receive medical care under a victim's name. The resulting errors in medical records can lead to misdiagnosis or dangerous treatments. For many patients, the aftermath of a data breach is a lengthy and stressful battle to restore their identity and protect their health.
Hackers go after companies like Craneware because their software touches a huge amount of sensitive information. Craneware's software processes substantial volumes of confidential medical and patient information for its client institutions.
This breach is not an isolated event. In March, health-tech company TriZetto announced that attackers had taken personal and health data belonging to over 3.4 million individuals. That same month, CareCloud, a firm that stores medical data, disclosed that one of its electronic health records repositories had been breached. In July of the prior year, billing firm Episource started alerting at least 5.4 million individuals that their data had been compromised in a cyberattack.
Craneware's billing platform is integral to the revenue cycle management of many healthcare providers, handling claims, payments, and patient data. This centralization makes it an attractive target for hackers seeking to exploit vulnerabilities in the healthcare IT ecosystem.
Until the investigation concludes, patients should take proactive steps to safeguard their information. Regularly reviewing Explanation of Benefits statements from insurance companies can help spot fraudulent claims, and placing a fraud alert on credit files adds an extra layer of protection. The company has not yet offered credit monitoring services, but affected individuals are advised to monitor their medical records and credit reports for signs of misuse.
Join Market Briefs, our free daily newsletter, for a quick daily rundown of the markets
