Craneware Reports Significant Cyber Incident Leading to Data Exfiltration

Edinburgh, Scotland – July 24, 2023 – Craneware, a prominent provider of financial software solutions for the US healthcare sector, has disclosed a significant cybersecurity incident that resulted in unauthorized access to its data environment and the subsequent exfiltration of a substantial volume of file names. The company, which plays a crucial role in the financial operations of approximately 2,000 hospitals and health systems across the United States, confirmed the breach in a public notice issued on July 20. While Craneware emphasizes that customer services remained operational and much of the accessed data was non-sensitive or publicly available regulatory information, the incident has raised concerns among cybersecurity experts regarding the potential exposure risks within the healthcare supply chain.

The breach, identified as involving unauthorized access to some of Craneware’s data environment, led to the viewing and exfiltration of a "significant volume" of file names. The company has stated that a large portion of these exfiltrated file names pertained to non-sensitive or already public regulatory data. However, the breach also encompassed the access and exfiltration of some employee data, as well as a subset of customer and partner records.

Craneware has proactively notified regulatory bodies in both the UK and the US. The Information Commissioner’s Office (ICO) in the United Kingdom and the Federal Bureau of Investigation (FBI) in the United States have been informed of the incident. The company is currently engaged in an ongoing response to the cyber-attack, working diligently to identify all affected parties with the intent of notifying them directly. As of the latest disclosure, no information has been released regarding the identity of the intruders or the specific methods employed to gain unauthorized access to Craneware’s systems.

Background and Scope of the Incident

Craneware, with its UK headquarters in Scotland and US headquarters in Florida, specializes in providing accounting and billing software critical to the financial management of US healthcare providers. Its product suite includes solutions like Trisus Chargemaster, which details pricing for billable items, procedures, and services, playing a vital role in the revenue cycle management of hospitals and insurers. The company’s extensive reach within the US healthcare system, partnering with a considerable number of hospitals and health systems, positions it as a key player in the financial infrastructure of the sector.

The cybersecurity incident, though detailed as involving the exfiltration of file names, has ignited discussions about the broader implications of data breaches within the healthcare supply chain. Cybersecurity professionals have acknowledged Craneware’s prompt action in containing the incident but have also voiced concerns about the sheer volume of data that was accessed.

Expert Reactions and Analysis

Darren Williams, CEO and Founder of BlackFog, an anti-data exfiltration (ADX) technology provider, highlighted the implications of the exfiltrated file names. "The significant number of file names being accessed and copied shows that determined attackers can carry out data exfiltration with relative ease," Williams stated. He further emphasized the potential risks, noting, "The exposure of customer and business partner records, along with public regulatory data, demonstrates that even incidents framed as low severity can carry real exposure risk."

Williams underscored Craneware’s strategic position within the healthcare supply chain, a sector that has become an increasingly attractive target for cybercriminals seeking to disrupt healthcare providers and impact patient care indirectly. Attackers often target third-party vendors like Craneware to gain leverage or access to the larger healthcare organizations they serve.

Echoing these concerns, James Neilson, SVP of Global at OPSWAT, commented on Craneware’s central role in the US healthcare ecosystem. "With Craneware widely used across the US healthcare system, the data it holds is an attractive target for cybercriminals," Neilson observed. "Craneware sits at the centre of the US healthcare ecosystem, supporting thousands of healthcare organisations. Although much of the data is non-sensitive, the very fact that it has been stolen can still be damaging." He elaborated that even the exposure of non-sensitive data can be detrimental, potentially revealing business relationships, operational structures, or internal processes that could be exploited by adversaries.

Both experts stressed the importance of the ongoing investigation. Williams concluded, "Craneware has already responded well, but must now determine the full scope of what was taken and confirm who’s affected." This sentiment points to the critical next steps in incident response: thorough forensic analysis to understand the precise nature and extent of the compromised data and to accurately identify individuals and organizations impacted.

Timeline of Disclosures and Actions

While a precise minute-by-minute chronology of the cyber incident itself remains undisclosed, the public timeline of Craneware’s response and notification provides a framework for understanding the company’s actions following the discovery of the breach.

• Discovery of the Incident: Craneware identified the cybersecurity incident involving unauthorized access to its data environment. The exact date of discovery has not been publicly stated, but it is understood to have preceded the official notification.
• Containment Efforts: Upon discovery, Craneware initiated its incident response protocols, working to contain the breach and prevent further unauthorized access. The company has indicated that no disruption to customer services occurred, suggesting that containment efforts were effective in isolating the impact on operational systems.
• Data Assessment: The company began assessing the nature and volume of data that had been accessed and exfiltrated. This involved identifying the types of files viewed and copied, distinguishing between sensitive and non-sensitive information, and categorizing any employee, customer, or partner data that may have been compromised.
• Regulatory Notification: As part of its legal and ethical obligations, Craneware formally notified the Information Commissioner’s Office (ICO) in the UK and the Federal Bureau of Investigation (FBI) in the US about the incident. This step is crucial for transparency and to engage with relevant law enforcement and data protection authorities.
• Public Disclosure: On July 20, 2023, Craneware issued a public notice to inform its stakeholders and the wider public about the cyber incident. This notice detailed the nature of the breach, the types of data impacted, and the company’s ongoing response.
• Ongoing Investigation and Notification: Craneware continues to conduct its investigation into the incident. A primary focus of this ongoing work is the identification of specific affected parties, which will then trigger direct notification to those individuals and organizations.

Broader Implications for Healthcare Cybersecurity

The Craneware incident underscores a persistent and evolving threat landscape for the healthcare industry. Healthcare organizations are increasingly reliant on third-party vendors for critical software and services, creating a complex web of interconnected systems that can be exploited by malicious actors. The sensitive nature of patient data, combined with the financial criticality of healthcare operations, makes this sector a prime target for cybercriminals seeking financial gain, disruption, or even espionage.

The exfiltration of file names, even if a significant portion is non-sensitive, can provide valuable intelligence to attackers. These file names can reveal the structure of an organization’s data, identify potential vulnerabilities, or offer clues about the types of sensitive information stored within the environment. Furthermore, the exposure of employee data and customer/partner records, even if a subset, can lead to identity theft, phishing attacks, or further targeted breaches.

Industry analysts have consistently highlighted the need for robust cybersecurity measures throughout the entire healthcare supply chain. This includes not only the direct security of healthcare providers but also the diligence in vetting and monitoring the security practices of their vendors. For companies like Craneware, which handle vast amounts of financial and operational data for healthcare institutions, maintaining the highest levels of security is paramount.

The incident serves as a stark reminder for all organizations operating within the healthcare ecosystem to:

• Implement Multi-Layered Security Defenses: Beyond perimeter security, organizations need robust endpoint protection, intrusion detection and prevention systems, and regular vulnerability assessments.
• Prioritize Data Minimization and Encryption: Holding only necessary data and encrypting it at rest and in transit significantly reduces the impact of a breach.
• Conduct Regular Security Audits and Penetration Testing: Proactive testing helps identify and remediate vulnerabilities before they can be exploited.
• Develop and Practice Comprehensive Incident Response Plans: A well-rehearsed plan ensures swift and effective action in the event of a breach, minimizing damage and recovery time.
• Foster a Culture of Security Awareness: Educating employees about cybersecurity threats and best practices is a crucial line of defense.
• Strengthen Third-Party Risk Management: Thoroughly vetting vendors and continuously monitoring their security posture is essential for protecting the entire supply chain.

Craneware’s swift reporting and engagement with authorities are positive steps, but the ongoing investigation will be critical in determining the full ramifications of this cyber incident and ensuring that appropriate measures are taken to prevent future occurrences. The healthcare sector, already grappling with the complexities of data privacy and security, must remain vigilant in its efforts to protect critical infrastructure and sensitive information from an ever-evolving array of cyber threats.