InfoSec Signals™
Sign InStart Free
CSV export is a subscriber feature

Updated under an hour ago ()

Chapter 14 of 14Oct 2023 to Sep 2026

Breaches and exploitation

Do waves of exploitation show up in healthcare hacking reports, and what should a program take from the comparison?

From Oct 2023 to Sep 2026, OCR received 1,924 hacking or IT incident reports (83% of all reports) while CISA confirmed 721 exploitations, 90 of them on network edge devices. OCR reports do not name the vulnerability behind a breach, so this chapter can show only whether the two move together, and that is correlation, not cause.

What this means for you

Hacking or IT incidents were 83% of the breach reports OCR received in these 36 months. OCR's reports do not say how attackers got in, and exploited vulnerabilities are one well-documented way in, so match CISA's exploited list against your inventory every week whatever the monthly correlation shows.

Do this next

Rate likelihood from your own exposure

This chapter's program actions come with a subscription

1,924
OCR hacking reports
Oct 2023 to Sep 2026
83%
Share of all OCR reports
of 2,318 reports
721
Confirmed exploitations
Oct 2023 to Sep 2026
90
On network edge devices
12%

a. Side by side

Healthcare hacking reports beside confirmed exploitation, month by month

The same 36 complete months on each chart. Click a month to open its breach reports or exploited CVEs. OCR reports do not name a CVE, so the charts can be compared but not joined.

OCR hacking or IT incident reports per month

1,924 hacking or IT incident reports.

Sources:

Table view
Oct 20233946
Nov 20236774
Dec 20236677
Jan 20245669
Feb 20245167
Mar 20248398
Apr 20245565
May 20244659
Jun 20243450
Jul 20244249
Aug 20245458
Sep 20243539
Oct 20245263
Nov 20245870
Dec 20244654
Jan 20256179
Feb 20254254
Mar 20255668
Apr 20255876
May 20255367
Jun 20256779
Jul 20255058
Aug 20256675
Sep 20256575
Oct 20254457
Nov 20253750
Dec 20255469
Jan 20265567
Feb 20266573
Mar 20267277
Apr 20264150
May 20265866
Jun 20265670
Jul 20266777
Aug 20263850
Sep 20263543

Confirmed exploitations per month

721 confirmed exploitations.

Sources: ;

Table view
Oct 2023183
Nov 2023221
Dec 2023100
Jan 2024215
Feb 2024114
Mar 202490
Apr 2024103
May 2024141
Jun 2024110
Jul 2024130
Aug 2024200
Sep 2024242
Oct 2024172
Nov 2024215
Dec 2024173
Jan 2025145
Feb 2025287
Mar 2025310
Apr 2025162
May 2025242
Jun 2025213
Jul 2025202
Aug 2025171
Sep 2025152
Oct 2025301
Nov 2025123
Dec 2025204
Jan 2026211
Feb 2026312
Mar 2026232
Apr 2026232
May 2026253
Jun 2026213
Jul 2026253
Aug 2026284
Sep 2026389

Edge-device exploitations per month

90 of them on network edge devices.

This is a comparison of two national counts, and any relationship between them is correlation, not cause. OCR breach reports do not name the vulnerability, product or entry point behind a breach. Reports are filed up to 60 days after a breach is discovered, discovery often trails the intrusion by months, and OCR posts reports after that, so recent months are incomplete and any link between the series would show up with a lag.

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 14: Breaches and exploitation

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.
  • Do exploitation waves lead hacking reports?
  • What this means for your program: 3 key points
  • 3 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Rate likelihood from your own exposure”
  • Exam angle for 5 CISSP, CISM and CISA domains, with a study prompt
Start freeOr subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.