Hackers stole data from tech firm used by thousands of US hospitals

A cyberattack on a Scottish technology company has compromised a significant amount of data, potentially affecting thousands of healthcare providers across the United States. Craneware, based in Edinburgh, disclosed that hackers stole customer information during a security breach, raising concerns about the exposure of sensitive health data.

The attack impacts hospitals, pharmacies, and clinics that rely on Craneware's software for patient billing and revenue management. The company serves over 3,000 healthcare organizations in the U.S., meaning a large number of patients could have their personal and medical information at risk. Craneware has not yet specified the exact type of data stolen, but the breach involves customer records.

This incident matters because healthcare data is highly sensitive and often targeted by cybercriminals. The stolen information could include patient names, addresses, insurance details, and medical histories, which can be used for identity theft or fraud. The breach also highlights the vulnerability of third-party vendors in the healthcare supply chain.

Craneware reported the attack on March 12, 2025, and stated that it is working with cybersecurity experts and law enforcement to investigate. The company has notified affected customers and is implementing additional security measures. No ransomware demand or perpetrator has been identified yet.

This is not the first cyberattack on a healthcare technology provider. In recent years, similar breaches have disrupted hospital operations and exposed patient data, leading to regulatory fines and lawsuits. Craneware's stock price dropped 4% following the announcement.

Moving forward, Craneware expects to complete its investigation within weeks and will provide updates to customers. The company may face legal action if the breach is found to violate data protection laws. Healthcare organizations using Craneware's software are advised to monitor their systems for suspicious activity and review their own security protocols.