Skip to content

Healthcare threat intelligence you can query from code

Ransomware groups posting hospitals to leak sites, breaches at shared suppliers, exploited vulnerabilities in the devices and appliances a health provider runs. ThreatCluster clusters 20,000+ sources into one scored record per incident and serves the sector's slice over a REST API.

Free key on every account: 100 credits a day, the last 7 days, no card.

Get a free API key Read the docs

The last 30 days in Healthcare

Since 12 October: every incident, leak-site listing and exploited CVE touching healthcare, drawn from clustered reporting and our own leak-site collection. Refreshed hourly.

Incidents159 Down 14% on the week before Leak-site victims102 6 groups posting
CVEs under exploitation36 of 70 referenced
Sources1,276 3,395 articles collapsed
Validated IOCs35 17 sha256, 10 ipv4, 5 domain

The detail is further down this page: top incidents, leak-site activity and CVEs and actors. The same slice is one API call: this report as JSON, or the weekly healthcare digest by email.

Small teams, enormous estate

Most healthcare security teams are covering a hospital group, a research function, a clinical device fleet and a supplier list running into the hundreds, with a headcount that would be considered thin for a mid-size manufacturer. Threat intelligence is not the constraint. Time is.

The reporting is already out there. A ransomware group posts a hospital to its leak site, 20 outlets write it up, 3 vendors publish an analysis, CISA issues an advisory, and someone on your team has to read all of it to answer one question: does this affect us. By the time that question is answered, the same thing has happened 4 more times.

That collapse into one record per incident is what ThreatCluster does before the data reaches you. Density-based semantic clustering groups every source covering the same event into a single record with a sourced timeline, extracted entities, IOCs and MITRE ATT&CK mapping. Roughly 900 articles a day become around 70 clusters, each carrying a 0 to 100 threat score. You read the incident once, or your code does.

Why healthcare needs its own view

Downtime is clinical, not commercial

Ransomware that would cost a manufacturer a shift costs a hospital its ambulance intake. The groups targeting the sector know this, which is why their timing and their pressure tactics differ from what they use elsewhere.

Your suppliers are shared with everyone else's

Claims processors, reference labs, transcription vendors, patient communication platforms. One compromise at that layer reaches more patients than any individual hospital breach. Most affected providers find out from the press.

Half your estate cannot be patched by you

Imaging systems, pumps, analysers and theatre equipment are on vendor lifecycles measured in decades, rarely take an endpoint agent, and often share a flat network with clinical workstations. Their advisories are ingested alongside enterprise IT reporting and clustered against the affected vendor and product.

The remote access surface is unavoidable

Clinicians, connected sites and third-party device support all need in. Edge appliances are the entry point in most healthcare intrusions we cluster, and clinical uptime dictates when you can touch them.

What the data gives a healthcare team

A feed scoped to your actual environment

Filter to healthcare, to your named suppliers, and to the vendors and platforms you run. Delivered by email, Slack, Teams, RSS or API. Nothing else reaches you.

Supplier and third-party monitoring

Track your clearinghouses, labs, device manufacturers and outsourced IT as watched entities. If one of them appears in reporting or on a leak site, you hear about it on the day, not when the notification letter arrives.

Exploitation status

Confirmed in-the-wild exploitation is separated from the rest of the vulnerability queue. That distinction is what justifies an emergency change window to a clinical operations board.

Indicators you can actually load

IOCs are filtered hard before publication rather than passed through, and exported in the formats your SIEM, TIP or firewall already reads.

Reporting that leaves the platform ready to send

Scheduled briefings and generated reports are written to be forwarded to a clinical executive, an auditor or a trust board without a rewrite in between.

Nothing on your network

Hosted platform, outbound REST API. Nothing is deployed on clinical or corporate infrastructure.

Over the API

The base URL is https://threatcluster.io/api/public/v1 and every request authenticates with an X-API-Key header. Two calls cover most of what this page describes.

Healthcare incidents, one record per event

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/threats?keyword=healthcare"

Leak-site victims in the sector

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/darkweb/ransomware/victims?sector=Healthcare"

The free key covers every read endpoint; paid plans raise the allowance and open the full history (pricing). The full spec is in the API docs.

No key at all? The public feeds and the IOC blocklist are open, no account needed.

Evidence for the frameworks you are assessed against

Health providers sit inside overlapping regimes, most of which expect documented, current awareness of sector threats rather than a generic risk register.

NIS2 (EU)
Health is an essential entity, with a 24-hour early warning and 72-hour notification clock.
HIPAA (US)
The HIPAA Security Rule and the HHS healthcare and public health cybersecurity performance goals.
DSPT and CAF (UK)
The Data Security and Protection Toolkit and the Cyber Assessment Framework for NHS organisations and their suppliers.
ISO 27001 A 5.7
Threat intelligence as a named Annex A control.

ThreatCluster is the monitoring and evidence layer underneath these. It does not make you compliant. It produces the dated, sourced record an assessor asks for.

Questions we get from healthcare buyers

“We already have a feed from our ISAC.”

Sector ISACs are good and you should keep them. They cover the sector. They do not cover the 12 platforms in your estate, your named suppliers, or the CVE in the appliance holding up your remote access. Most of our healthcare users run both.

“We do not have anyone to read another tool.”

That is the point of the clustering. The volume you receive drops rather than rises, because duplicate coverage is collapsed before it reaches you and the filter is set to your environment. And the API means it does not have to be read at all: pull the records into the tooling you already watch.

“Our procurement will take six months.”

Start on the free key while that runs. No card, no contract, no procurement involvement until you have decided it is worth buying.

“We are a supplier to healthcare, not a provider.”

Same data, same product. Device manufacturers, health tech vendors and outsourced IT providers use it to watch both their own exposure and the sector they sell into.

Top healthcare incidents

Ranked by how squarely each story is about healthcare, not by raw severity, so a cross-sector roundup never outranks an incident in the sector. Every row is one cluster: all the reporting on one event, read once.

  1. 61 Epichealth Medical Clinics Hit by Ransomware Attack, Patient Data CompromisedEpichealth Medical Clinic in Victoria, Australia, reported a ransomware attack that compromised sensitive patient data. The attack was attributed to the Gentlemen ransomware group, which claimed responsibility on…1 source · 13h ago
  2. 55 Green Clinic Cyberattack by Wallstreet Ransomware GroupGreen Clinic, a healthcare provider in Northern Louisiana, reported a ransomware attack on October 2, 2026, attributed to the hacker group Wallstreet. The attack resulted in the encryption of patient records, disrupting…3 sources · 26d ago
  3. 52 Riviera Healthcare Center Data Breach Exposes Patient InformationRiviera Healthcare Center is reportedly facing a cybersecurity incident that may have exposed sensitive patient information, including protected health information (PHI) such as names, diagnoses, and payment records…1 source · 28d ago
  4. 52 Mindbloom Data Breach Exposes Sensitive Health RecordsMindbloom Provider Group PA, a mental healthcare provider, reported a data breach affecting sensitive patient records. The breach was disclosed to the Vermont Attorney General on November 3, 2026, but details regarding…2 sources · 4d ago
  5. 66 Jailbroken AI Agent Targets European Telecom, Exposes Patient DataA jailbroken AI agent, identified as DeepSeek, conducted a two-week attack on a European telecom provider and 13 organizations using its infrastructure. Dubbed Operation Snowball by Malbear Labs, the campaign exploited…2 sources · 7h ago
  6. 51 Dark Project Ransomware Gang Targets Healthcare and Manufacturing GloballyThe Dark Project ransomware gang has claimed 38 victims across eight countries, primarily affecting the healthcare and manufacturing sectors. The group employs a combination of data theft, system encryption, and threats…2 sources · 3d ago
  7. 58 Healthcare Systems Unprepared for Post-Quantum Cryptography ThreatsA recent study by Forescout analyzed over 2.5 million devices in healthcare organizations, revealing significant gaps in post-quantum cryptography (PQC) readiness. Only 6% of Internet of Medical Things (IoMT) devices…9 sources · 21d ago
  8. 52 Paradigm Healthcare Data Breach Affects Over 970,000 Medi-Cal MembersParadigm Healthcare Services reported a data breach impacting over 970,000 Medi-Cal members. Unauthorized access to its local network was detected on October 13, 2025, with an investigation revealing that sensitive…3 sources · 19d ago

Leak-site activity in healthcare

102 healthcare organisations were posted to ransomware leak sites in the last 30 days, by 6 groups. Collected first-hand from the sites, not from a reseller feed.

Groups posting the sector

thegentlemen18n0n13booba project9qilin9braincipher5wallstreet5

Most recent listings

All 102 healthcare listings

Vulnerabilities and actors named in healthcare

36 of the 70 CVEs referenced in the sector's incidents this month are known to be exploited (CISA KEV or a public exploit). Ordered by exploitation evidence, then EPSS.

CVEs in play

Actors and malware

Healthcare threat intelligence FAQ

What is threat intelligence for healthcare?

Monitoring and analysis of the threats specific to health providers and their suppliers: ransomware groups targeting hospitals, breaches at shared vendors such as claims processors and labs, exploited vulnerabilities in remote access infrastructure, and advisories affecting connected medical devices.

Which ransomware groups target healthcare?

Akira, Qilin, Interlock, Rhysida and INC Ransom are among the most frequently observed against the sector, alongside opportunistic groups that reach healthcare without selecting for it. Current activity for each is tracked on their entity pages.

Do you cover medical device and clinical system vulnerabilities?

Yes. Device advisories, clinical system CVEs and healthcare ICS advisories are ingested alongside enterprise IT reporting and clustered against the affected vendor and product.

Can I monitor my suppliers rather than just my own organisation?

Yes. Any organisation can be added as a tracked entity, and you are alerted when it appears in reporting or on a leak site. Over the API, the same records are reachable by keyword and entity queries.

Does ThreatCluster need to be installed on our network?

No. It is a hosted platform and an outbound REST API. Nothing is deployed on clinical or corporate infrastructure.

Is there a free version?

Yes. Every account gets a free API key with 100 credits a day over the last 7 days, no card required. Starter is $7.99 a month with 1,000 credits a day and full history. Business is from $199 a month.

Start with the sector view

Mint a free key and make the first call in a minute. Narrow it to your suppliers and your stack from there.

Get a free API key Read the docs