Craneware healthcare billing software investigates major attack

In this episode, we break down four major healthcare cybersecurity incidents: the Craneware billing platform attack, a nonprofit breach affecting 75,000 individuals, Medtronic's exposure of nearly 370,000 patient records, and ApolloMD's $4.02 million settlement following a ransomware attack. These cases underscore critical lessons for healthcare organizations on vendor management, network segmentation, and incident response planning.

Episode Transcript

SPEAKER_00 (00:00):
You're listening to Pow Box Weekly fully automated.

(00:03):
I'm Jen, cybersecurity analyst,professional pessimist.
And I'm Alex, healthcare IT guywho keeps hoping next week's
news will be boring.
It never is.

SPEAKER_01 (00:13):
It really never is.
So let's start with Craneware.
Healthcare Billing SoftwareCompany currently investigating
what they're calling a majorattack.

SPEAKER_00 (00:22):
And for folks who don't know Craneware, they help
U.S.
hospitals and pharmacies managerevenue, maintain federal
compliance.
Big footprint.

SPEAKER_01 (00:31):
Right.
And what we know so far is thata significant volume of file
names were viewed andexfiltrated.
Their words.

SPEAKER_00 (00:38):
File names.
So not necessarily the filesthemselves.

SPEAKER_01 (00:42):
That's the interesting part.
Could be reconnaissance.
Could be worse.
We don't have full scope yet.
But if you're a hospital thatrelies on craneware for billing
and compliance data, you need tobe asking questions right now.

SPEAKER_00 (00:55):
Not waiting for the press release.

SPEAKER_01 (00:57):
Exactly.
Reach out to your vendor,understand your exposure.
Don't assume no news is goodnews.

SPEAKER_00 (01:03):
Alright, next up, the LGBTQ Center of Orange
County disclosed a breachaffecting about 75,000
individuals.

SPEAKER_01 (01:12):
This one hurts.
Nonprofits serving vulnerablecommunities are increasingly in
the crosshairs.
And the data stolen here?
Medical history, treatmentinformation.

SPEAKER_00 (01:22):
Which, for this population, could be
particularly sensitive.

SPEAKER_01 (01:26):
Extremely.
We're not just talking identitytheft risk.
We're talking safety, outing,discrimination.
The stakes are different.

SPEAKER_00 (01:34):
And the takeaway for other nonprofits?

SPEAKER_01 (01:37):
You're not too small to be a target.
In fact, your mission might makeyou more attractive to bad
actors.
Security basics, patching,access controls, monitoring,
they apply to everyone.

SPEAKER_00 (01:48):
Moving on to Medtronic.
Nearly 370,000 patients notifiedafter a breach tied to their
corporate IT systems.

SPEAKER_01 (01:57):
And this one got ugly fast.
Shiny Hunters, the extortiongroup, listed them on their leak
site, claimed over 9 millionrecords, terabytes of internal
data.

SPEAKER_00 (02:08):
Medtronic says no impact on product security,
which is good.

SPEAKER_01 (02:12):
It is.
Medical devices staying secureis the priority.
But corporate IT systems stillhold patient data, still hold
employee data, still hold enoughto cause real harm.
So what's the lesson here?
Segment your networks.
Assume breach.
And understand that productsecurity and data security are
two different conversations.

SPEAKER_00 (02:33):
Last one, Apollo MD.
They've agreed to a$4.02 millionsettlement following a class
action lawsuit.

SPEAKER_01 (02:42):
This stems from a breach back in May of 2025.
Ransomware Group Killin tookcredit.
Apollo MD never officiallyconfirmed the cause, but here we
are.

SPEAKER_00 (02:52):
$4 million.

SPEAKER_01 (02:54):
4 million.
And that's just the settlement.
That's not counting legal fees,remediation, reputational
damage.

SPEAKER_00 (03:01):
So for the compliance officers listening,
this is the cost of not beingready.

SPEAKER_01 (03:07):
This is one version of the cost.
It can get worse.
The real takeaway?
Incident response plans aren'toptional.
Neither is cyber insurance.
Neither is honest assessment ofyour security posture.

SPEAKER_00 (03:19):
Alright, let's bring it together.
We've got a billing platformbreach, a nonprofit hit, a
medical device company exposed,and a multimillion dollar
settlement.

SPEAKER_01 (03:30):
Four different stories, same theme.
None of this is bad luck.
It's bad configurations, blindspots, unpatched systems,
unmonitored access.

SPEAKER_00 (03:41):
And most of it fixable.

SPEAKER_01 (03:43):
Most of it absolutely fixable.
Not easy, but fixable.
The organizations that investnow, they're not in next week's
newsletter.

SPEAKER_00 (03:52):
But that's the goal.
That's always the goal.
Thanks for listening, everyone.
Stay safe out there.
And patch your stuff.
Seriously.