The Craneware breach: when attackers read your file names before your files

On July 20, 2026, Craneware plc, the Edinburgh-based provider of healthcare financial and revenue-cycle software, disclosed to the London Stock Exchange that it had suffered a cybersecurity incident involving unauthorized access to part of its data environment. According to public reporting from outlets including IT Pro, HIPAA Journal, and Security Magazine, the company said attackers viewed and exfiltrated a significant volume of file names, along with a percentage of employee data and a subset of customer and partner records. Craneware characterized much of the affected data as non-sensitive or already public regulatory information, said the incident was contained with no disruption to customer services or operations, and reported it to the UK Information Commissioner’s Office and the U.S. Federal Bureau of Investigation. No threat actor has claimed responsibility, and the company has not described a ransomware component.

It would be easy to file this under low-severity: no encryption, no confirmed patient data, business as usual. But Craneware’s software reaches an enormous footprint of the U.S. healthcare system, and one phrase in the disclosure deserves more attention than it is getting. The attackers did not just take files. They took the file names.

A list of file names is a map. Directory structures, project labels, client identifiers, contract references, dates, version tags, and the words organizations put in front of "final" and "confidential" describe the shape and value of an estate before a single document is opened. For an attacker deciding what to come back for, what to sell, or what to name in an extortion note, an index of the file tree is often worth more than any one file in it.

Producing that index is not a passive act. Someone, or something, walked the shares and repositories and read metadata at scale across the paths that hold the business: the material that accumulates on network-attached storage and file services and is reached over SMB, NFS, S3, and Web Drive. That traversal is a distinct behavior. It does not resemble a clinician opening a record or an analyst editing a spreadsheet, and it is exactly the kind of pattern a storage layer can recognize while it is underway, if the storage layer is watching operations rather than merely fulfilling them.

The absence of encryption is not the absence of harm; it is the current shape of it. Steal-and-leak intrusions turn on reading and copying live data through a trusted path, and they are engineered to look ordinary. The whole point of enumerating file names and pulling a curated subset is to move without tripping the controls built for the loud version of the attack. Endpoint and network tools sit upstream of the read that actually matters, and a file system that is not analyzing behavior cannot separate a credentialed bulk read from an ordinary Tuesday.

Detection has to reach the data itself. Profiling normal access per user, host, and dataset makes the anomalous case legible: a session that suddenly enumerates thousands of paths it has no prior relationship with, or reads across directories no single role should touch, departs from an established baseline. That departure is the moment to act, because it precedes the exfiltration rather than following it. Active Defense exists to recognize that shift and cut the session before the copy completes, on live data, without waiting for a signature.

Least privilege has to be real and enforced where the files live, not just asserted at the identity provider. Attribute-based access control constrains each operation to what a user, on a given host, in a given context legitimately needs, so a single account cannot quietly range across an entire file estate to build a map of it. The blast radius of a compromised credential is a design choice; most organizations discover theirs during incident response.

And once something has been read, an immutable, per-operation audit trail is the difference between a precise statement and a worst-case assumption. Craneware was able to say what categories of data were touched and to characterize their sensitivity; many organizations cannot, and default to disclosing everything. A tamper-proof record of who read which objects, when, over which protocol, turns notification from guesswork into arithmetic, and turns recovery into a surgical operation rather than a wholesale rollback. The moment a breach like this can be shaped is while the reads are happening. By then the credential is valid, the session is authorized, and the only thing standing between reconnaissance and a full exfiltration is whether anything at the data layer noticed the pattern.