Sources

Every dataset InfoSec Signals collects, straight from the agency that publishes it: what we take, where it shows up on this site, how often it refreshes and under what terms. Counts and fetch times are live from our database.

Sources collected

5 more planned

8,619

Records on file

Breach reports plus signal items

6 behind

Freshness

HHS OCR Breach Portal, Federal Register API, NIST CSRC drafts open for comment, CISA cybersecurity advisories, openFDA device recalls, NIST news

Breaches and enforcement

What HHS OCR publishes about breaches of unsecured protected health information.

HHS OCR Breach Portal

U.S. Department of Health and Human Services, Office for Civil Rights

Behind schedule

Reports on file: 7,967
Last successful fetch: 4 days ago; Sep 23, 2026, 10:33 PM UTC
Refresh schedule: Daily at 11:00 UTC; cron 0 11 * * *
Newest submission: Sep 6, 2026

Why it is behind: the last successful fetch was 4 days ago, and we expect one at least every 48 hours.

Last attempt: Sep 23, 2026, 10:33 PM UTC (4 days ago): succeeded.
No recent attempt: No attempt in the last 48 hours although the job should run every 24 hours: the scheduled job did not run. Check the cron job and its logs in Vercel.

Records already on file remain available.

What we collect

Every breach report affecting 500 or more individuals, from both of OCR's lists (under investigation and the archive of resolved cases): entity name, state, covered entity type, individuals affected, submission date, breach type, location of the information, business associate involvement and OCR's resolution narrative.

Both exports in full on every run; additions, moves between lists, edits and removals are recorded as a change history.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative.

Where it is used

Browse these records on Signals

Cite as: U.S. Department of Health and Human Services, Office for Civil Rights. (n.d.). Breach portal: Notice to the Secretary of HHS breach of unsecured protected health information [Data set]. https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf
Endpoint: https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf (CSV export of both lists)

Regulation and rulemaking

Rules, proposed rules and notices from the agencies that regulate health data.

Federal Register API

Office of the Federal Register, National Archives and Records Administration

Behind schedule

Items on file: 393
Last successful fetch: 4 days ago; Sep 23, 2026, 11:07 PM UTC
Refresh schedule: Every 6 hours, on the hour UTC; cron 0 */6 * * *
Newest item: Sep 23, 2026

Why it is behind: the last successful fetch was 4 days ago, and we expect one at least every 12 hours.

Last attempt: Sep 23, 2026, 11:07 PM UTC (4 days ago): succeeded.
No recent attempt: No attempt in the last 12 hours although the job should run every 6 hours: the scheduled job did not run. Check the cron job and its logs in Vercel.

Records already on file remain available.

What we collect

Rules, proposed rules, notices and presidential documents: title, document type, abstract, publication date, agencies and docket numbers.

HHS documents matching HIPAA, cybersecurity, information blocking, breach notification or health information technology, plus FTC documents on the Health Breach Notification Rule; the last 400 days on each run.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. FederalRegister.gov is not the official legal edition; the official edition is published on govinfo.gov.

Where it is used

Browse these records on Signals

Cite as: National Archives and Records Administration. (n.d.). Federal Register API v1. https://www.federalregister.gov/developers/documentation/api/v1
Endpoint: https://www.federalregister.gov/api/v1/documents.json

Standards (NIST)

Security and privacy publications while they are open for public comment.

NIST CSRC drafts open for comment

National Institute of Standards and Technology, Computer Security Resource Center

Behind schedule

Items on file: 10
Last successful fetch: 4 days ago; Sep 23, 2026, 11:07 PM UTC
Refresh schedule: Every 6 hours, on the hour UTC; cron 0 */6 * * *
Newest item: Sep 21, 2026

Why it is behind: the last successful fetch was 4 days ago, and we expect one at least every 12 hours.

Last attempt: Sep 23, 2026, 11:07 PM UTC (4 days ago): succeeded.
No recent attempt: No attempt in the last 12 hours although the job should run every 6 hours: the scheduled job did not run. Check the cron job and its logs in Vercel.

Records already on file remain available.

What we collect

Draft SP 800, FIPS, IR and CSWP publications open for public comment: title, summary, publication date and link, tagged by series number.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. NIST notes that some of its content may be protected outside the United States.

Where it is used

Browse these records on Signals

Cite as: National Institute of Standards and Technology. (n.d.). Drafts open for comment [Feed]. Computer Security Resource Center. https://csrc.nist.gov/publications/drafts-open-for-comment
Endpoint: https://csrc.nist.gov/CSRC/media/feeds/pubs/drafts-open-for-comment.json

Advisories and recalls (CISA, FDA)

Vulnerability advisories and device recalls that affect clinical and IT environments.

CISA cybersecurity advisories

Cybersecurity and Infrastructure Security Agency

Behind schedule

Items on file: 30
Last successful fetch: 4 days ago; Sep 23, 2026, 11:07 PM UTC
Refresh schedule: Every 6 hours, on the hour UTC; cron 0 */6 * * *
Newest item: Sep 23, 2026

Why it is behind: the last successful fetch was 4 days ago, and we expect one at least every 12 hours.

Last attempt: Sep 23, 2026, 11:07 PM UTC (4 days ago): succeeded.
No recent attempt: No attempt in the last 12 hours although the job should run every 6 hours: the scheduled job did not run. Check the cron job and its logs in Vercel.

Records already on file remain available.

What we collect

Every advisory in CISA's combined feed: ICS medical device advisories (ICSMA), ICS advisories, joint cybersecurity advisories and alerts, with title, summary and date. Medical device and healthcare items are tagged.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. Advisories may quote vendor material, which remains the vendor's.

Where it is used

Browse these records on Signals

Cite as: Cybersecurity and Infrastructure Security Agency. (n.d.). Cybersecurity advisories [RSS feed]. https://www.cisa.gov/news-events/cybersecurity-advisories
Endpoint: https://www.cisa.gov/cybersecurity-advisories/all.xml

openFDA device recalls

U.S. Food and Drug Administration

Behind schedule

Items on file: 211
Last successful fetch: 4 days ago; Sep 23, 2026, 11:07 PM UTC
Refresh schedule: Every 6 hours, on the hour UTC; cron 0 */6 * * *
Newest item: Sep 18, 2026

Why it is behind: the last successful fetch was 4 days ago, and we expect one at least every 12 hours.

Last attempt: Sep 23, 2026, 11:07 PM UTC (4 days ago): succeeded.
No recent attempt: No attempt in the last 12 hours although the job should run every 6 hours: the scheduled job did not run. Check the cron job and its logs in Vercel.

Records already on file remain available.

What we collect

Medical device recalls whose stated reason mentions software, firmware, network, remote access, vulnerability or cybersecurity: recalling firm, device, class, reason and status.

Recalls posted in the last 365 days, up to 300 per run. The keyword filter is a heuristic; the linked FDA record is authoritative.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative. openFDA data is provided as is, and its use does not imply FDA endorsement.

Where it is used

Browse these records on Signals

Cite as: U.S. Food and Drug Administration. (n.d.). openFDA device recall API [Data set]. https://open.fda.gov/apis/device/recall/
Endpoint: https://api.fda.gov/device/recall.json

News

Announcements from the publishing agencies. No commercial or third-party news feeds are collected.

NIST news

National Institute of Standards and Technology

Behind schedule

Items on file: 8
Last successful fetch: 4 days ago; Sep 23, 2026, 11:07 PM UTC
Refresh schedule: Every 6 hours, on the hour UTC; cron 0 */6 * * *
Newest item: Sep 18, 2026

Why it is behind: the last successful fetch was 4 days ago, and we expect one at least every 12 hours.

Last attempt: Sep 23, 2026, 11:07 PM UTC (4 days ago): succeeded.
No recent attempt: No attempt in the last 12 hours although the job should run every 6 hours: the scheduled job did not run. Check the cron job and its logs in Vercel.

Records already on file remain available.

What we collect

NIST news items that read as security or privacy (cybersecurity, cryptography, identity, zero trust, CSF, SP 800, FIPS and similar): title, summary and date.

Terms

A work of the U.S. Government, not subject to copyright in the United States (17 U.S.C. § 105). Signals reproduces it with attribution; the publisher's record is authoritative.

Where it is used

Browse these records on Signals

Cite as: National Institute of Standards and Technology. (n.d.). News [RSS feed]. https://www.nist.gov/news-events/news
Endpoint: https://www.nist.gov/news-events/news/rss.xml

Reference data

Fixed datasets the analytics and tagging rely on. They are not refreshed on a schedule.

2020 Census apportionment results, Table 2: Resident population
Per-capita breach rates by state in Analytics. Territories other than Puerto Rico are not in the table and get no rate.
U.S. Census Bureau. (2021). 2020 Census apportionment results, Table 2: Resident population for the 50 states, the District of Columbia, and Puerto Rico: 2020 Census [Data set].
CISSP exam outline (eight domains)
Domain labels on signals and in the weekly digest, assigned by a documented keyword heuristic. Study hints, not an official mapping.
ISC2. (2024). CISSP certification exam outline (effective April 15, 2024).
CISM job practice (four domains)
Domain labels on signals and in the weekly digest (keyword heuristic).
ISACA. (2022). CISM exam content outline (effective June 1, 2022).
CISA job practice (five domains)
Domain labels on signals and in the weekly digest (keyword heuristic).
ISACA. (2024). CISA exam content outline (effective August 1, 2024).

Planned, not collected yet

Researched and on the roadmap. Nothing on this site draws on them today.

CVE records (cvelistV5)
CVE Program
For CVE matching against a DueCare organization's technology inventory.
Known Exploited Vulnerabilities catalog
CISA
Exploited-in-the-wild flag for CVE matches.
OCR resolution agreements and civil money penalties
HHS Office for Civil Rights
Enforcement outcomes with Security Rule citations.
HSCC Cybersecurity Working Group publications
Health Sector Coordinating Council
Sector guidance; needs an HTML scrape.
HHS 405(d) resources
HHS 405(d) Program
Health Industry Cybersecurity Practices; needs a headless fetch.

How to read this page

Last successful fetch is when our scheduled job last retrieved the source without error. A source is marked behind schedule when that is more than two scheduled intervals ago, which means at least one run was missed. Records already on file stay available while a source is behind.

When a source is behind or has never been fetched, its card says why: when the last attempt ran and how it ended, the kind of failure if it failed (an HTTP error from the publisher, a timeout or network error, or a response we could not read), whether the scheduled job ran at all, and whether this is an environment where scheduled jobs do not run. Error details stay in our logs, since they can include request credentials.

The publisher's record is always authoritative: every breach report and signal links back to it. Signals adds tags, exam domain hints and extracted corrective actions, which are our own reading and are labelled as such. Questions about a source: MTC Group.