A disclosure that remains open

Craneware (LSE:CRW), the Edinburgh-based supplier of financial performance software to US hospitals, disclosed on 20 July 2026 that it had identified a cyber security incident involving unauthorised access to part of its data environment. More than three months later, the disclosures so far leave important questions unanswered, and the company's Annual General Meeting on 27 November is the next scheduled occasion at which shareholders will meet the board.

According to the July announcement, the company said its incident response plan had been activated, the board had appointed external cyber security and forensic specialists, and the incident had been contained. External specialists reportedly confirmed no residual indicators of compromise, and the company said there had been no disruption to customer services or its wider operations.

What was taken

The company said a preliminary investigation found that a significant Volume of file names had been viewed and exfiltrated, and that much of that material appeared non-sensitive or already public regulatory information. It also said that a percentage of employee data and a subset of customer and partner records had been accessed and exfiltrated. Craneware notified the UK Information Commissioner's Office and the US Federal Bureau of Investigation, and said it was working with advisers to identify affected parties and prepare notifications.

The company did not disclose the number of individuals affected, the attack method, how long access lasted, or whether any group had claimed responsibility. The company had not confirmed whether patient health information was involved. Those gaps make it difficult to judge the likely overall scale of any remediation or notification obligations.

Why it matters for this business

Craneware's customers are hospitals and health systems, and the company cites around 2,000 US hospitals as partners. In our interpretation, trust in data handling is central to selling software that sits close to hospital billing and Revenue processes. Even where stolen data appears low risk, security specialists have warned it could be used for Phishing and follow-on attacks.

The incident also landed during a difficult period. In results published on 21 September 2026 for the year to 30 June, Craneware (LSE:CRW) reported revenue of US$206.0m, broadly stable, adjusted EBITDA up 3% to US$67.1m and statutory profit before tax of US$25.8m, with operating cash conversion of 98%. The company had already reset its expectation for revenue in the current year to about US$185m, and the results referred to the post-period incident as under investigation.

Risks and uncertainties

The financial cost of the incident has not been quantified. Possible costs include forensic and legal fees, customer notifications, any regulatory penalties or litigation, and potential effects on renewals or new sales. None of these has been confirmed, and it would be speculative to assume any outcome. Craneware reports in US dollars, while its shares trade in pence; they were about 1052p at the close of the 2 November session.

Readers should also note that the July statements described a preliminary investigation, so the scope of affected data could change as work continues. Further disclosures may also have been made outside the regulatory news service, such as notices to affected individuals.

Next steps

Craneware posted its Annual Report and notice of AGM on 29 October, with the meeting scheduled for 10am on 27 November in Edinburgh. The company said in its July statement that it would provide further updates as the investigation progressed. Investors and customers will be watching for any statement on the final scope of the incident, notification of affected parties, associated costs and any measurable effect on customer relationships or renewals.