Sources

Every dataset InfoSec Signals collects, straight from the agency that publishes it: what we take, where it shows up on this site, how often it refreshes and under what terms. Counts and fetch times are live from our database.

Sources collected

3 more planned

239,316

Records on file

Breach reports plus signal items

All current

Freshness

Every source fetched on schedule

Breaches and enforcement

What HHS OCR publishes about breaches of unsecured protected health information.

HHS OCR Breach Portal

U.S. Department of Health and Human Services, Office for Civil Rights

Current

Reports on file: 8,045
Last successful fetch: 12 hours ago; Oct 25, 2026, 7:00 AM ET
Refresh schedule: Daily at 7:00 AM ET (6:00 AM ET in winter); cron 0 11 * * *
Newest submission: Oct 1, 2026

What we collect

Every breach report affecting 500 or more individuals, from both of OCR's lists (under investigation and the archive of resolved cases): entity name, state, covered entity type, individuals affected, submission date, breach type, location of the information, business associate involvement and OCR's resolution narrative.

Both exports in full on every run; additions, moves between lists, edits and removals are recorded as a change history.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative.

Where it is used

Browse these records on SignalsOfficial site

Cite as: U.S. Department of Health and Human Services, Office for Civil Rights. (n.d.). Breach portal: Notice to the Secretary of HHS breach of unsecured protected health information [Data set]. https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf
Endpoint: https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf (CSV export of both lists)

Vulnerabilities (CVE)

CVE records, refreshed every ten minutes, with the analysis, exploitation and exploit-prediction data used to rank them and match them to subscribers' inventories.

CVE records (cvelistV5)

CVE Program

Current

CVEs it informs: 105,368
Last successful fetch: under an hour ago; Oct 25, 2026, 6:50 PM ET
Refresh schedule: Every 10 minutes; cron */10 * * * *
Newest CVE: Oct 25, 2026

What we collect

Every new and updated CVE record as the CVE Program publishes it: identifier, state, title, description, assigning CNA, dates, CVSS and CWE where the CNA or CISA's ADP container gives them, affected products with their version ranges, and references.

From go-live forward, plus the history loaded from NVD (below). Rejected records are kept and marked, never matched.

Terms

Provided under the CVE Program's terms of use, which permit copying and redistribution with attribution. The CVE record is authoritative.

Where it is used

Browse these records on SignalsOfficial site

Cite as: CVE Program. (n.d.). cvelistV5 [Data set]. GitHub. https://github.com/CVEProject/cvelistV5
Endpoint: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/deltaLog.json and the per-record JSON 5 files it links

National Vulnerability Database (CVE API 2.0, CPE API 2.0)

National Institute of Standards and Technology

Current

CVEs it informs: 113,145
Last successful fetch: under an hour ago; Oct 25, 2026, 6:23 PM ET
Refresh schedule: Hourly; cron 23 * * * *
Newest CVE: Oct 25, 2026

What we collect

For each CVE, NVD's applicability statements (the products and version ranges it affects, as CPE names), its CVSS score and CWE. The CPE dictionary, reduced to products, backs the product pickers here and in DueCare. Also the history used before go-live: CVEs published in the last twelve months, every CVE in CISA's KEV catalog, and every CVE for a product someone has in their inventory.

Changes are followed hourly through NVD's last-modified window. NVD analysis can lag publication; until it arrives a CVE is matched on its CNA record alone.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. This product uses the NVD API but is not endorsed or certified by the NVD.

Where it is used

Browse these records on SignalsOfficial site

Cite as: National Institute of Standards and Technology. (n.d.). NVD developers: Vulnerabilities and products APIs. https://nvd.nist.gov/developers
Endpoint: https://services.nvd.nist.gov/rest/json/cves/2.0 and https://services.nvd.nist.gov/rest/json/cpes/2.0

Known Exploited Vulnerabilities catalog

Cybersecurity and Infrastructure Security Agency

Current

CVEs it informs: 1,756
Last successful fetch: 15 hours ago; Oct 25, 2026, 4:23 AM ET
Refresh schedule: Hourly; cron 23 * * * *
Newest CVE: Oct 25, 2026

What we collect

Every catalog entry: CVE identifier, date added, the remediation due date CISA sets for federal agencies, required action and known ransomware use.

Applied once a day. A CVE in the catalog is flagged "known exploited" and ranked first everywhere.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative.

Where it is used

Browse these records on SignalsOfficial site

Cite as: Cybersecurity and Infrastructure Security Agency. (n.d.). Known exploited vulnerabilities catalog [Data set]. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Endpoint: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Exploit Prediction Scoring System (EPSS)

FIRST

Current

CVEs it informs: 10,157
Last successful fetch: 14 hours ago; Oct 25, 2026, 5:25 AM ET
Refresh schedule: Hourly; cron 23 * * * *
Newest CVE: Oct 25, 2026

What we collect

The daily EPSS probability and percentile for CVEs that are matched to an inventory, known exploited, or recent and high or critical.

Used to rank matches, never to hide one.

Terms

Provided by FIRST free of charge; FIRST asks that use be attributed to EPSS.

Where it is used

Ranking of CVE matches (subscribers)

Browse these records on SignalsOfficial site

Cite as: Jacobs, J., Romanosky, S., Edwards, B., Adjerid, I., & Roytman, M. (2021). Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice, 2(3), Article 20. https://doi.org/10.1145/3436242
Endpoint: https://api.first.org/data/v1/epss

Regulation and rulemaking

Rules, proposed rules and notices from the agencies that regulate health data.

Federal Register API

Office of the Federal Register, National Archives and Records Administration

Current

Items on file: 470
Last successful fetch: 5 hours ago; Oct 25, 2026, 2:00 PM ET
Refresh schedule: Every 6 hours, on the hour; cron 0 */6 * * *
Newest item: Oct 26, 2026

What we collect

Rules, proposed rules, notices and presidential documents: title, document type, abstract, publication date, agencies and docket numbers.

HHS documents matching HIPAA, cybersecurity, information blocking, breach notification or health information technology, plus FTC documents on the Health Breach Notification Rule; the last 400 days on each run.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. FederalRegister.gov is not the official legal edition; the official edition is published on govinfo.gov.

Where it is used

Browse these records on SignalsOfficial site

Cite as: National Archives and Records Administration. (n.d.). Federal Register API v1. https://www.federalregister.gov/developers/documentation/api/v1
Endpoint: https://www.federalregister.gov/api/v1/documents.json

Standards (NIST)

Security and privacy publications while they are open for public comment.

NIST CSRC drafts open for comment

National Institute of Standards and Technology, Computer Security Resource Center

Current

Items on file: 14
Last successful fetch: 5 hours ago; Oct 25, 2026, 2:00 PM ET
Refresh schedule: Every 6 hours, on the hour; cron 0 */6 * * *
Newest item: Oct 21, 2026

What we collect

Draft SP 800, FIPS, IR and CSWP publications open for public comment: title, summary, publication date and link, tagged by series number.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. NIST notes that some of its content may be protected outside the United States.

Where it is used

Browse these records on SignalsOfficial site

Cite as: National Institute of Standards and Technology. (n.d.). Drafts open for comment [Feed]. Computer Security Resource Center. https://csrc.nist.gov/publications/drafts-open-for-comment
Endpoint: https://csrc.nist.gov/CSRC/media/feeds/pubs/drafts-open-for-comment.json

Advisories and recalls (CISA, FDA)

Vulnerability advisories and device recalls that affect clinical and IT environments.

CISA cybersecurity advisories

Cybersecurity and Infrastructure Security Agency

Current

Items on file: 105
Last successful fetch: 5 hours ago; Oct 25, 2026, 2:00 PM ET
Refresh schedule: Every 6 hours, on the hour; cron 0 */6 * * *
Newest item: Oct 23, 2026

What we collect

Every advisory in CISA's combined feed: ICS medical device advisories (ICSMA), ICS advisories, joint cybersecurity advisories and alerts, with title, summary and date. Medical device and healthcare items are tagged.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. Advisories may quote vendor material, which remains the vendor's.

Where it is used

Browse these records on SignalsOfficial site

Cite as: Cybersecurity and Infrastructure Security Agency. (n.d.). Cybersecurity advisories [RSS feed]. https://www.cisa.gov/news-events/cybersecurity-advisories
Endpoint: https://www.cisa.gov/cybersecurity-advisories/all.xml

openFDA device recalls

U.S. Food and Drug Administration

Current

Items on file: 247
Last successful fetch: 5 hours ago; Oct 25, 2026, 2:00 PM ET
Refresh schedule: Every 6 hours, on the hour; cron 0 */6 * * *
Newest item: Oct 21, 2026

What we collect

Medical device recalls whose stated reason mentions software, firmware, network, remote access, vulnerability or cybersecurity: recalling firm, device, class, reason and status.

Recalls posted in the last 365 days, up to 300 per run. The keyword filter is a heuristic; the linked FDA record is authoritative.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. openFDA data is provided as is, and its use does not imply FDA endorsement.

Where it is used

Browse these records on SignalsOfficial site

Cite as: U.S. Food and Drug Administration. (n.d.). openFDA device recall API [Data set]. https://open.fda.gov/apis/device/recall/
Endpoint: https://api.fda.gov/device/recall.json

News

Announcements from the publishing agencies. No commercial or third-party news feeds are collected.

NIST news

National Institute of Standards and Technology

Current

Items on file: 9
Last successful fetch: 5 hours ago; Oct 25, 2026, 2:00 PM ET
Refresh schedule: Every 6 hours, on the hour; cron 0 */6 * * *
Newest item: Oct 16, 2026

What we collect

NIST news items that read as security or privacy (cybersecurity, cryptography, identity, zero trust, CSF, SP 800, FIPS and similar): title, summary and date.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative.

Where it is used

Browse these records on SignalsOfficial site

Cite as: National Institute of Standards and Technology. (n.d.). News [RSS feed]. https://www.nist.gov/news-events/news
Endpoint: https://www.nist.gov/news-events/news/rss.xml

Reference data

Fixed datasets the analytics and tagging rely on. They are not refreshed on a schedule.

2020 Census apportionment results, Table 2: Resident population
Per-capita breach rates by state in Analytics. Territories other than Puerto Rico are not in the table and get no rate.
U.S. Census Bureau. (2021). 2020 Census apportionment results, Table 2: Resident population for the 50 states, the District of Columbia, and Puerto Rico: 2020 Census [Data set]. www.census.gov
CISSP exam outline (eight domains)
Domain labels on signals and in the weekly digest, assigned by a documented keyword heuristic. Study hints, not an official mapping.
ISC2. (2024). CISSP certification exam outline (effective April 15, 2024). www.isc2.org
CISM job practice (four domains)
Domain labels on signals and in the weekly digest (keyword heuristic).
ISACA. (2022). CISM exam content outline (effective June 1, 2022). www.isaca.org
CISA job practice (five domains)
Domain labels on signals and in the weekly digest (keyword heuristic).
ISACA. (2024). CISA exam content outline (effective August 1, 2024). www.isaca.org

Planned, not collected yet

Researched and on the roadmap. Nothing on this site draws on them today.

OCR resolution agreements and civil money penalties
HHS Office for Civil Rights
Enforcement outcomes with Security Rule citations.
Publisher's page
HSCC Cybersecurity Working Group publications
Health Sector Coordinating Council
Sector guidance; needs an HTML scrape.
Publisher's page
HHS 405(d) resources
HHS 405(d) Program
Health Industry Cybersecurity Practices; needs a headless fetch.
Publisher's page

How to read this page

Last successful fetch is when our scheduled job last retrieved the source without error. A source is marked behind schedule when that is more than two scheduled intervals ago, which means at least one run was missed. Records already on file stay available while a source is behind.

When a source is behind or has never been fetched, its card says why: when the last attempt ran and how it ended, the kind of failure if it failed (an HTTP error from the publisher, a timeout or network error, or a response we could not read), whether the scheduled job ran at all, and whether this is an environment where scheduled jobs do not run. Error details stay in our logs, since they can include request credentials.

The publisher's record is always authoritative: every breach report and signal links back to it. Signals adds tags, exam domain hints and extracted corrective actions, which are our own reading and are labelled as such. Questions about a source: MTC Group.