U.K.-based healthcare billing software maker Craneware is responding to a cyber-attack in which hackers stole a "significant volume" of customer data from its systems, according to a filing with the London Stock Exchange. The company said attackers appear to have been expelled but that its investigation is ongoing, with a "percentage" of employee, customer, and partner records exfiltrated. Craneware's software is used by U.S. clinics, hospitals, and pharmacies, and through its 2021 acquisition of Sentry, the company gained access to roughly 147 million patient records. It has not disclosed exactly what data was taken or whether the attackers have made ransom demands.

The incident is the latest in a sustained pattern of attacks against the tech vendors that support the healthcare sector. TriZetto confirmed the theft of more than 3.4 million people's personal and health data in March, CareCloud disclosed a breach the same month, Episource notified at least 5.4 million people last year, and the Change Healthcare attack in 2024 exposed medical records for at least 192 million people. The pattern is consistent: attackers target billing, revenue cycle, and data-management vendors because a single compromise reaches a vast downstream population of patients whose PHI cannot be reissued and whose exposure creates lifetime fraud risk. For providers, the exposure comes largely through vendors they don't control, and for vendors, the concentration of PHI makes them uniquely valuable targets and uniquely exposed to extortion leverage.

Reducing this exposure requires visibility that spans vendor environments, SaaS integrations, and data flows across the healthcare stack — not just the provider's or vendor's own perimeter. Unified platforms like NIKSUN help give healthcare providers and their technology vendors the cross-domain context needed to detect and prevent unauthorized access to patient data. Read more about this story on our LinkedIn page