Healthcare threat intelligence you can query from code
Ransomware groups posting hospitals to leak sites, breaches at shared suppliers, exploited vulnerabilities in the devices and appliances a health provider runs. ThreatCluster clusters 20,000+ sources into one scored record per incident and serves the sector's slice over a REST API.
Free key on every account: 100 credits a day, the last 7 days, no card.
Small teams, enormous estate
Most healthcare security teams are covering a hospital group, a research function, a clinical device fleet and a supplier list running into the hundreds, with a headcount that would be considered thin for a mid-size manufacturer. Threat intelligence is not the constraint. Time is.
The reporting is already out there. A ransomware group posts a hospital to its leak site, 20 outlets write it up, 3 vendors publish an analysis, CISA issues an advisory, and someone on your team has to read all of it to answer one question: does this affect us. By the time that question is answered, the same thing has happened 4 more times.
That collapse into one record per incident is what ThreatCluster does before the data reaches you. Density-based semantic clustering groups every source covering the same event into a single record with a sourced timeline, extracted entities, IOCs and MITRE ATT&CK mapping. Roughly 900 articles a day become around 70 clusters, each carrying a 0 to 100 threat score. You read the incident once, or your code does.
Why healthcare needs its own view
Downtime is clinical, not commercial
Ransomware that would cost a manufacturer a shift costs a hospital its ambulance intake. The groups targeting the sector know this, which is why their timing and their pressure tactics differ from what they use elsewhere.
Your suppliers are shared with everyone else's
Claims processors, reference labs, transcription vendors, patient communication platforms. One compromise at that layer reaches more patients than any individual hospital breach. Most affected providers find out from the press.
Half your estate cannot be patched by you
Imaging systems, pumps, analysers and theatre equipment are on vendor lifecycles measured in decades, rarely take an endpoint agent, and often share a flat network with clinical workstations. Device advisories, clinical system CVEs and healthcare ICS advisories are ingested alongside enterprise IT reporting and clustered against the affected vendor and product.
The remote access surface is unavoidable
Clinicians, connected sites and third-party device support all need in. Edge appliances are the entry point in most healthcare intrusions we cluster, and clinical uptime dictates when you can touch them.
What the data gives a healthcare team
A feed scoped to your actual environment
Filter to healthcare, to your named suppliers, and to the vendors and platforms you run. Delivered by email, Slack, Teams, RSS or API. Nothing else reaches you.
Supplier and third-party monitoring
Track your clearinghouses, labs, device manufacturers and outsourced IT as watched entities. If one of them appears in reporting or on a leak site, you hear about it on the day, not when the notification letter arrives.
Exploitation status
Confirmed in-the-wild exploitation is separated from the rest of the vulnerability queue. That distinction is what justifies an emergency change window to a clinical operations board.
Indicators you can actually load
IOCs are filtered hard before publication rather than passed through, and exported in the formats your SIEM, TIP or firewall already reads.
Reporting that leaves the platform ready to send
Scheduled briefings and generated reports are written to be forwarded to a clinical executive, an auditor or a trust board without a rewrite in between.
Nothing on your network
Hosted platform, outbound REST API. Nothing is deployed on clinical or corporate infrastructure.
Over the API
The base URL is https://threatcluster.io/api/public/v1 and every request authenticates with an X-API-Key header. Two calls cover most of what this page describes.
Healthcare incidents, one record per event
curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/threats?keyword=healthcare"Leak-site victims in the sector
curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/darkweb/ransomware/victims?sector=Healthcare"The free key covers every read endpoint, incidents, IOCs, entities, vulnerabilities and dark web, with 100 credits a day over the last 7 days and 30 requests a minute. Paid plans raise the allowance and open the full history; they are on the pricing page. The full 45-endpoint spec is in the API docs.
No key at all? The public feeds and the IOC blocklist are open, no account needed.
Evidence for the frameworks you are assessed against
Health providers sit inside overlapping regimes, most of which expect documented, current awareness of sector threats rather than a generic risk register.
- NIS2 (EU)
- Health is an essential entity, with a 24-hour early warning and 72-hour notification clock.
- HIPAA (US)
- The HIPAA Security Rule and the HHS healthcare and public health cybersecurity performance goals.
- DSPT and CAF (UK)
- The Data Security and Protection Toolkit and the Cyber Assessment Framework for NHS organisations and their suppliers.
- ISO 27001 A 5.7
- Threat intelligence as a named Annex A control.
ThreatCluster is the monitoring and evidence layer underneath these. It does not make you compliant. It produces the dated, sourced record an assessor asks for.
Questions we get from healthcare buyers
“We already have a feed from our ISAC.”
Sector ISACs are good and you should keep them. They cover the sector. They do not cover the 12 platforms in your estate, your named suppliers, or the CVE in the appliance holding up your remote access. Most of our healthcare users run both.
“We do not have anyone to read another tool.”
That is the point of the clustering. The volume you receive drops rather than rises, because duplicate coverage is collapsed before it reaches you and the filter is set to your environment. And the API means it does not have to be read at all: pull the records into the tooling you already watch.
“Our procurement will take six months.”
Start on the free key while that runs. No card, no contract, no procurement involvement until you have decided it is worth buying.
“We are a supplier to healthcare, not a provider.”
Same data, same product. Device manufacturers, health tech vendors and outsourced IT providers use it to watch both their own exposure and the sector they sell into.
What we are tracking in the sector right now
Every incident here is drawn from live clustering. The healthcare entity page carries the full history: active clusters, associated threat groups, and the most recent reporting, updated continuously. The same records come back from the keyword=healthcare query above.
Healthcare threat intelligence FAQ
What is threat intelligence for healthcare?
Monitoring and analysis of the threats specific to health providers and their suppliers: ransomware groups targeting hospitals, breaches at shared vendors such as claims processors and labs, exploited vulnerabilities in remote access infrastructure, and advisories affecting connected medical devices.
Which ransomware groups target healthcare?
Akira, Qilin, Interlock, Rhysida and INC Ransom are among the most frequently observed against the sector, alongside opportunistic groups that reach healthcare without selecting for it. Current activity for each is tracked on their entity pages.
Do you cover medical device and clinical system vulnerabilities?
Yes. Device advisories, clinical system CVEs and healthcare ICS advisories are ingested alongside enterprise IT reporting and clustered against the affected vendor and product.
Can I monitor my suppliers rather than just my own organisation?
Yes. Any organisation can be added as a tracked entity, and you are alerted when it appears in reporting or on a leak site. Over the API, the same records are reachable by keyword and entity queries.
Does ThreatCluster need to be installed on our network?
No. It is a hosted platform and an outbound REST API. Nothing is deployed on clinical or corporate infrastructure.
Is there a free version?
Yes. Every account gets a free API key with 100 credits a day over the last 7 days, no card required. Starter is $19.99 a month with 1,000 credits a day and full history. Business is $399 a month.
Start with the sector view
Mint a free key and make the first call in a minute: 100 credits a day over the last 7 days, no card. Narrow it to your suppliers and your stack from there.