Craneware Data Breach Puts 147M Patient Records and Thousands of US Hospitals at Risk

For healthcare providers, the Craneware breach is a stark reminder that even third-party billing vendors can become the weakest link in patient data protection. With 147 million patient records potentially at risk, hospitals must now brace for regulatory scrutiny and operational disruptions.

UK-based healthcare billing software maker Craneware disclosed on Monday that hackers stole a “significant volume” of data from its systems, a breach that threatens thousands of U.S. hospitals, clinics, and pharmacies that rely on its platform for managing billing and patient records. The company, which filed a statement with the London Stock Exchange, said the intruders had been expelled but an investigation is ongoing, and the full extent of what was taken—including any patient medical or insurance data—remains unclear. The attack is the latest in a series of cyber incidents targeting technology vendors that serve the U.S. healthcare sector, underscoring the severe risk posed by concentration of sensitive data in a few supply chain nodes.

“

Craneware shares dropped more than 6% on the London Stock Exchange, erasing gains from earlier in the year and signaling investor anxiety over potential regulatory fines, customer churn, and the cost of remediation.

Craneware’s flagship accounting and billing software is deeply embedded in the financial operations of a vast network of healthcare providers. The company has not specified which of its customer data was compromised, but acknowledged that a percentage of employee, customer, and partner records were exfiltrated. Of particular concern is the patient data vault it inherited through its 2021 acquisition of Florida-based Sentry Data Systems. That deal gave Craneware control of 147 million patient records collected over two decades—a staggering repository that includes medical histories, treatment details, and billing information. Even if only a fraction of that dataset was accessed, the breach could become one of the largest health data exposures in recent memory.

The timing is critical. Healthcare supply chain attacks have intensified over the past year as threat actors recognize that compromising a single software provider can yield access to multiple downstream customers. By exfiltrating data, hackers can extort not only the vendor but also the healthcare organizations whose patient records are at stake. Craneware did not disclose whether a ransom demand was made, and CEO Keith Neilson did not respond to media queries, leaving open the possibility that communication with the attackers is limited. The breach’s impact extends beyond data theft: hospitals and pharmacies dependent on Craneware may face billing disruptions, delayed payments, and operational paralysis while systems are secured.