Craneware says hackers stole data in cyberattack on U.S. hospitals

Hackers stole employee, customer and partner data in a cyberattack on Craneware, the Edinburgh-based company whose billing software helps thousands of U.S. hospitals, pharmacies and clinics process patient charges. Its services stayed operational and there was no service disruption, but the breach raised the prospect that health-related data moved through a vendor platform could have been exposed.

The software provider serves more than 2,000 U.S. hospitals, and its systems sit between providers and the billing records that follow a patient through care, payment and collections. A third-party vendor can be an entry point for information tied to patient accounts, employee records and business partners even when a hospital itself is not the direct target.

Craneware shares fell 7% after the disclosure.

The HIPAA Journal put average healthcare data breach costs at $10.93 million in 2026, and TechTarget put the number of individuals affected by healthcare data breaches reported to the U.S. Office for Civil Rights so far this year at more than 19 million. A 2024 attack on Change Healthcare also disrupted pharmacies across the United States.