UK-based healthcare billing software maker Craneware is responding to a cyberattack in which hackers stole a “significant volume” of customer data from its systems, the company said Monday.

The company said the hackers appear to have been kicked out of its systems, but its investigation into the breach is ongoing, according to a statement filed with the London Stock Exchange.

Craneware’s flagship accounting and billing software is used by thousands of clinics, hospitals and pharmacies across the United States. The company did not say exactly what type of data was taken in the breach, only noting that a “percentage” of employee data, customer data and partner records had been extracted.

The company, whose software helps healthcare providers bill patients for services, handles large amounts of medical records and patient data on behalf of its clients. When it bought Sentry, a Florida-based pharmaceutical software maker, in 2021, Craneware said it gained access to the company’s 147 million patient records that had been collected over two decades.

Craneware CEO Keith Neilson did not respond to TechCrunch’s questions about the incident or whether hackers had contacted the company to request some type of demand, such as a ransom. Following the publication, Craneware Chief Growth Officer Ian Armstrong said the company was still investigating, but had no further comment on the incident.

It is still unclear whether the company’s systems can receive email amid the ongoing cyberattack.

While the details of the attack are still under investigation, this is the latest data breach in recent months in which hackers have targeted technology companies that supply technology and services to the U.S. healthcare sector. By compromising the software that many healthcare providers use to analyze and understand their billing processes, hackers can access large amounts of patients’ medical and health-related data and extort companies with threats to publicly release the information.

Craneware is the latest healthcare technology giant to be breached in the past year.

In March, healthcare revenue technology company TriZetto confirmed that hackers stole personal and health data of more than 3.4 million people from its systems during a previous cyberattack. That same month, medical data storage giant CareCloud reported a breach of one of its patient electronic medical record stores, but has not yet said how much data was taken.

Last July, medical billing company Episource began notifying at least 5.4 million people that hackers had stolen their information.

The largest breach of US medical and healthcare data occurred in 2024, when a Russian-speaking ransomware gang hacked Change Healthcare, owned by UnitedHealth. Hackers stole the medical and patient records of at least 192 million people, which the company admitted affected a “substantial proportion of people in the United States.”

Updated with a response from Craneware.