Notice of Cyber Security Incident

Craneware (AIM: CRW.L), a leader in healthcare financial performance solutions, reports that it has identified and is responding to a cyber security incident involving unauthorised access to a subset of its data environment.

The Company's incident response plan has been activated, including the appointment by the Board of external cyber security and forensic specialists. Their investigation is ongoing, alongside the Craneware IT team and the Company's retained cyber security service providers.

The incident has been contained and there has been no disruption to customer services or to the Company's operations. The external specialists have confirmed that there are no residual indicators of compromise arising from the cyber security incident in the Company's systems

The Company has notified the relevant regulators and law enforcement agencies, including the Information Commissioner's Office in the UK and Federal Bureau of Investigations in the US.

Investigations so far have established that a significant volume of file names were viewed and exfiltrated. The current assessment is that a large element of the data involved is non-sensitive or already public regulatory data. A percentage of Craneware employee data as well as a subset of customer and partner records have been accessed and exfiltrated.

The Company is continuing to assess the precise nature and scope of all the data involved and is working with its advisers to identify affected parties and prepare appropriate notifications, including any required further notifications to relevant authorities, in each case in accordance with applicable regulatory obligations.

The Company will update the market as appropriate.

Learn more at www.thecranewaregroup.com