Craneware says cyber attack stole customer and employee data
Summary
Healthcare software provider Craneware confirmed that data including employee, customer and partner records was accessed and exfiltrated. The incident is contained, and the company is investigating and has notified UK and US authorities.
Key points
- Craneware confirmed a cyber attack involving the viewing and exfiltration of a significant volume of file names.
- The company said a percentage of employee data and a subset of customer and partner records were accessed and exfiltrated.
- Craneware said much of the data involved is assessed as non-sensitive or already public regulatory data.
- The incident has been contained, with no reported disruption to customer services or operations.
- The company and external specialists reported no signs that its systems were compromised.
- Craneware is investigating the incident and has notified the UK Information Commissioner’s Office and the US FBI.
Article Details
- Victim Organization
- Craneware
- Incident Type
- Cyber attack involving unauthorized access to and exfiltration of customer, partner, and employee data.
- Data Types Exposed
- Employee data
- Customer records
- Partner records
- File names, including data described by Craneware as non-sensitive or already public regulatory data
- Affected Records
- A subset of customer and partner records and a percentage of Craneware employee data; exact quantities not disclosed.
- Affected Data Size
- Craneware described a significant volume of file names as viewed and exfiltrated; the exact volume and scope of affected data were still under assessment.
- Operational Impact
- The incident was contained and did not disrupt customer services or Craneware's operations. Craneware and external specialists reported no signs that its systems were compromised.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed