Healthcare billing giant serving thousands of US hospitals confirms major data breach

When 147 Million De-identified Patient Records Sit Behind One Company's Firewall

Craneware, a U.K.-based healthcare billing software maker, disclosed on Monday that hackers stole a significant volume of customer data from its systems. The company announced the breach in a filing to the London Stock Exchange. Craneware's billing and accounting software is used by thousands of U.S. clinics, hospitals, and pharmacies, and the company has said it handles data tied to as many as 147 million patient records, described as de-identified in materials related to its Sentry acquisition. 12

The company said hackers appear to have been expelled from its networks, though the investigation is ongoing. Craneware has not specified what categories of data were taken, saying only that employee data, customer data, and partner records were among the files removed from its systems. CEO Keith Neilson has not responded to press questions about the incident, including whether the attackers have contacted Craneware with demands. 1

The 147 million figure traces to Craneware's 2021 acquisition of Sentry, a Florida-based pharmacy software maker. At the time, Craneware said the deal would bring its reach to nearly 40% of U.S. hospitals. How many of those records reside in Craneware's current systems, and how many were exposed in this breach, remain open questions the company has not addressed. 12

The structural problem is this: a single billing software company, operating between thousands of healthcare providers and their patients, can amass a data footprint that dwarfs what any individual hospital holds. One breach at that intermediary level potentially exposes records from every provider on its client roster. No hospital CIO can patch that attack surface, because the vulnerability sits in the vendor's systems, not theirs.

Craneware is the latest entry in a year-long series of breaches hitting the same layer of the healthcare supply chain. In March, healthcare revenue tech firm TriZetto confirmed that more than 3.4 million people had personal and health data stolen during a prior cyberattack. That same month, medical data storage giant CareCloud reported a breach of its electronic health records stores but has not disclosed how much data was taken. Last July, medical billing company Episource began notifying at least 5.4 million people that their information had been stolen. 1

The largest remains Change Healthcare, the UnitedHealth-owned company breached in 2024 by a Russian-speaking ransomware gang. The company ultimately disclosed that records of at least 192 million people were stolen, acknowledging the figure covered a large share of the U.S. population. 1

The common thread across these incidents is not a particular vulnerability or a specific attacker. It is that healthcare data has centralized faster than healthcare security has adapted. Billing companies, claims processors, and data storage vendors now aggregate patient records at a scale that makes them higher-value targets than any individual hospital. The HHS Office for Civil Rights, which investigates breaches of protected health information affecting 500 or more individuals, does classify business associates as regulated entities under HIPAA. 3

Whether that classification has produced enforcement pressure that actually reduces risk at the vendor layer is a separate question. The OCR breach portal shows the agency can negotiate corrective action plans and refer cases for further action. But the cadence of large-scale breaches at healthcare middleware companies has not slowed.

Craneware has not disclosed the full scope of data stolen, the identity of the attackers, or whether patient medical records were among the material taken. The investigation is ongoing. What is confirmed is that a company at the center of the U.S. healthcare billing infrastructure, handling data connected to tens of millions of patients, has acknowledged a significant data theft. The specifics will emerge in the coming weeks. The structural conditions that made this breach possible are not going anywhere.