Where the story stands

Craneware (LSE:CRW) posted its Annual Report on 29 October 2026 and confirmed that its Annual General Meeting will be held at 10am on 27 November at its Edinburgh offices. With that meeting now approaching, the focus is on what the healthcare software group has, and has not, said publicly about the cyber security incident it first disclosed on 20 July 2026.

The company has described the breach as contained and operationally non-disruptive, but it has not yet publicly set out a financial cost, an insurance position or a final account of which customers were affected. The most recent formal reference came in its FY26 results on 21 September, which described the matter as still under investigation.

About the company

Craneware is an Edinburgh-based provider of software and services to US healthcare organisations. Its products help hospitals, clinics and pharmacies manage Revenue integrity, pharmacy operations and drug-pricing programmes such as 340B, a US scheme that allows eligible providers to buy outpatient drugs at reduced prices. Because almost all customers are American, the company reports in US dollars, even though its headquarters and listing are in the UK.

The Business relies on holding sensitive financial and operational data on behalf of its customers. That makes information security a core part of its commercial credibility.

What happened in July

LSE:CRW identified unauthorised access to part of its data environment, activated its incident response plan and appointed external cyber security and forensic specialists. It said the intrusion had been contained, that those specialists had found no remaining indicators of compromise, and that there had been no disruption to customer services or wider operations.

Early findings indicated that a significant Volume of file names had been viewed and taken. The company said much of that material appeared to be non-sensitive or already public regulatory data, but that a portion of employee data and a subset of customer and partner records had also been accessed. It was reported that the UK Information Commissioner's Office and the US Federal Bureau of Investigation had been notified.

Why it matters for this business

LSE:CRW sells revenue integrity, pharmacy and 340B drug-pricing software to US hospitals, clinics and pharmacies, and its model depends on customers entrusting it with financial and operational data. The Edinburgh-based group reports in US dollars because almost all of its customers are American healthcare providers. Trust in data handling is central to renewals, even where services kept running.

The incident also landed during a difficult period. FY26 revenue for the year to 30 June was $206.0 million, essentially flat, while statutory pre-tax profit rose 7.4% to $25.8 million. Adjusted EBITDA was $67.1 million, and the Dividend was held at 32p. Management reset FY27 revenue expectations to about $185 million, in line with annual recurring revenue, citing uncertainty in the 340B market. Chief executive Keith Neilson said 2026 had been challenging. The board said the cyber event did not change its confidence in the long-term opportunity.

Risks and open questions

The main uncertainties are cost and consequence. Investigation, notification and remediation expenses have not been quantified, nor has any insurance recovery. Data-protection authorities in the UK and US could take further interest once the scope is confirmed, and affected customers or employees may seek redress, although no claims have been disclosed. A less visible risk is commercial: hospital buyers reviewing vendor security could lengthen sales cycles at a time when the company is already guiding to lower revenue.

The financial context of FY26

Flat revenue of $206.0m and adjusted EBITDA of $67.1m give the group an adjusted Margin of about 32.6%. Statutory pre-tax profit rose 7.4% to $25.8m, which means profit grew while revenue did not, helped by cost control and lower charges below the adjusted line. The dividend held at 32p. The reset of FY27 revenue expectations to about $185m, in line with annual recurring revenue, means that the company expects lower revenue next year, which it attributes to uncertainty in the 340B market.

This context matters for the cyber incident. A company expecting a lower revenue year has less room to absorb unexpected costs, and customer confidence becomes more important when growth is subdued.

What the company has and has not said

The July disclosure described unauthorised access to part of the data environment, with specialist advisers appointed and no remaining indicators of compromise. It said the incident was contained and caused no operational disruption. What remains undisclosed is the financial effect: investigation, notification and remediation costs have not been quantified, and the insurance position has not been described. The FY26 results on 21 September described the matter as still under investigation, so the AGM on 27 November is the next scheduled occasion for shareholders to ask questions.

What customers and regulators look for

Customers in healthcare typically assess vendors against data-protection obligations in contracts and under US privacy rules, and many review a supplier's security posture before renewing. The company has said it had found that a portion of employee data and a subset of customer and partner records had been accessed. Notification to affected parties and cooperation with authorities are the steps that follow such findings. The interim results to 31 December 2026 should reveal whether any costs are reported separately and whether customer retention has been affected.

The role of the order book and cash

A large order book gives a company a degree of visibility over future revenue, because the work has already been contracted. What matters then is the margin on that work and the timing of cash receipts. If a contract requires costs to be paid before milestone payments arrive, cash can fall even while profit rises.

Cash on the Balance Sheet provides a cushion for those timing differences and gives the board room to consider dividends, acquisitions or buybacks. The disclosures above show the amount held and how it has changed.

What to watch at and after the AGM

AGMs often bring a short trading statement, though Craneware has not said whether one will accompany the 27 November meeting. Shareholders will be looking for any update on the investigation's conclusions, notifications to affected parties, quantified costs and whether customer retention has been affected. Beyond that, the interim results for the half to 31 December 2026 should show whether the reset revenue outlook is holding and whether incident-related costs are being reported as separate items. Confirmation that the investigation has closed would also remove one source of uncertainty.