Identity-first threat intelligence for healthcare.

The balance between spending resources on patient care and everything else is a constant struggle for healthcare organizations. This, lean teams that often need to fight for resources despite the risk to patient safety and the organization, and the sensitive data (PHI, PII, and PCI) create a combination  of systemic vulnerabilities that make them disproportionately attractive to cybercriminals. We’ll break it down further here

• High-value, high-urgency environment: Ransomware actors specifically target hospitals because clinical urgency creates pressure to pay. A system outage in a hospital is not only a financial problem, but it can also prevent clinicians from accessing medication records or imaging results.
• Access to electronic health records (EHR), pharmacy tools, and billing via infostealer malware: Employees’ devices are compromised by malware that silently harvests login credentials, session cookies, and browser data. These are packaged into stealer logs and sold on cybercrime forums, giving threat actors authenticated access to EHR systems, billing platforms, and pharmacy dispensing tools without triggering traditional security alerts.
• Legacy systems with extended attack surfaces: Hospitals operate decades-old medical devices (IoMT), imaging systems (PACS), and interoperability platforms that were never designed with modern security in mind. Patching these systems is often operationally impractical.
• Third-party and supply chain risk: Specialty practice management platforms, telehealth vendors, and revenue cycle management companies all hold PHI or system access credentials. Flare Research found credentials for platforms like SimplePractice, WebPT, Omnicell, and Imprivata appearing in stealer logs across underground markets.
• Cybersecurity tooling itself being compromised: In one of the most alarming findings from our 2025 research, credentials for healthcare compliance platforms (Censinet, Clearwater) and medical device security tools (Medigate, Cynerio, Asimily) were found in stealer logs, handing attackers a roadmap of known vulnerabilities.

Healthcare credential theft grew significantly in 2025, moving against the broader trend. While total infostealer log volumes on underground forums fell 32.2% year-over-year, healthcare-specific credential exposure increased 33%: from 26,117 logs in 2024 to 34,875 logs in 2025.

By the end of 2025, approximately 2,900 compromised devices with healthcare system access (predominantly EHR/EMR access) were being shared on criminal marketplaces every single month. An October–November 2025 spike drove volumes to their highest recorded point.

Geographic concentration: The United States accounted for 48% of all healthcare stealer logs over the past two years, which was the single largest source globally by a wide margin. Within EMEA, several markets are growing at rates that significantly outpace the regional average, including Kenya (7.3×), Ukraine (6.2×), Uganda (4.6×), and Turkey (3.8×).

The acceleration of healthcare-targeted credential theft, even as general infostealer activity declined, signals that threat actors are deliberately prioritizing healthcare credentials as a high-value asset, which is a trend that shows no sign of reversing.

Stealer logs are structured data files generated by infostealer malware, which is malicious software that silently infects a device and harvests usernames, passwords, session cookies, browser autofill data, and system information. The collected data is packaged into a “log” and sold or traded on cybercrime forums and Telegram channels, often for just a few dollars per device.

For healthcare providers, a single stealer log can contain authenticated credentials to multiple critical systems from a single compromised employee device: an EHR login, a billing platform password, a pharmacy dispensing system token, and even the credentials to a single sign-on (SSO) platform like Imprivata that unlocks virtually every other clinical application.

Our analysis of 154,000 stealer logs identified credentials for EHR, telehealth platforms, revenue cycle systems, pharmacy dispensing tools, PACS imaging systems, and healthcare compliance platforms: the full breadth of a hospital’s digital infrastructure.

Our analysis of 60,992 healthcare stealer logs found that 73.9% contained direct EHR/EMR access, credentials to systems holding patient demographics, SSNs, diagnoses, medications, and insurance data. Beyond EHR platforms, the logs also contained 301 Imprivata clinical SSO credentials (effectively the master key to hospital digital infrastructure), 900 pharmacy and medication management system credentials including controlled substance access, and 50 logs with access to hospital cybersecurity and compliance tools like Censinet, Clearwater, Medigate, and Cynerio. 

A single compromised credential can unlock patient records, pharmacy dispensing systems, insurance billing platforms, and clinical SSO that cascades into full hospital infrastructure compromise and breach risk.

The volume-to-impact relationship in healthcare is counterintuitive: the categories with the fewest logs often carry the greatest risk. A compromised Imprivata credential (SSO) unlocks every clinical application a hospital runs: from EHR to pharmacy to imaging. Compromised compliance platform credentials expose a hospital’s entire known vulnerability inventory. These low-frequency, maximum-impact exposures represent what security teams must prioritize.

When Electronic Health Record (EHR) or Electronic Medical Record (EMR) credentials are stolen and end up in a stealer log, an attacker gains direct access to the most regulated and most sensitive data in healthcare: PHI.

A single compromised EHR account typically exposes:

• Patient demographics and Social Security numbers
• Insurance details and billing information
• Current diagnoses, medications, and clinical notes
• Lab results and imaging referrals
• Complete longitudinal medical history

The HIPAA exposure: Any unauthorized access to PHI is a reportable breach under HIPAA, regardless of whether data was exfiltrated. A single compromised credential can trigger mandatory HHS notification, OCR investigation, and potential civil monetary penalties, even if the attacker only viewed records.

The patient safety dimension: EHR access can be used to alter medication records, fabricate orders, or manipulate treatment history, with potentially fatal clinical consequences.

We found 45,060 logs containing EHR/EMR credentials in the 2024–2025 dataset, which represents 73.9% of all healthcare-exposed logs, or nearly three out of every four compromised devices with healthcare access. This makes EHR credential monitoring a non-negotiable baseline for any healthcare security program.

PHI is the most expensive PII on the dark web, commanding an estimated $300 per record on dark web markets, which is 4x more than bank account credentials and 17x more than credit card numbers. That price signal drives threat actor behavior directly toward healthcare targets. While a stolen credit card is an inconvenience, federal laws typically mean $0 out of pocket and limited exposure. A compromised health record can go undiscovered for months or years and commit costly insurance fraud in that time.

We found that across 60,992 healthcare-exposed stealer logs, healthcare credential theft grew 33% year-over-year from 2024 to 2025, even as overall infostealer volumes declined by 32%. The breach threat is concentrating on healthcare. Roughly 2,900 compromised devices with healthcare access surface on underground markets every month.

Flare is a cyber threat intelligence platform that provides continuous, automated monitoring of the dark web, Telegram channels, and stealer log marketplaces, delivering real-time alerts when your organization’s credentials, domains, or systems appear in underground communities.

How Flare works for healthcare organizations:

• Stealer log monitoring: Flare indexes and analyzes stealer logs distributed across criminal forums and Telegram channels at scale. When logs contain credentials matching your monitored identifiers such as EHR URLs, corporate email domains, and SSO platforms, Flare surfaces an alert with full context: which device was compromised, which systems are at risk, and when the log was posted.
• Dark web forum surveillance: Flare maintains persistent visibility into cybercrime communities, including forums where initial access brokers advertise entry into healthcare networks and ransomware groups discuss targeting decisions.
• Telegram channel monitoring: A significant and growing portion of healthcare stealer log distribution occurs through Telegram. Flare’s coverage extends across thousands of threat actor channels, correlating mentions and credential posts to monitored organizations in real time.
• Healthcare-specific research: Flare Research authors reports like The State of Healthcare Credential Exposure, which provides ongoing sector analysis that informs alert prioritization. Healthcare security teams receive context about which system types (EHR, Imprivata, pharmacy dispensing) carry the greatest operational risk when compromised.
• Fast time-to-action: Alerts are delivered with recommended response actions, such as credential rotation, device isolation, incident response initiation, enabling lean security teams to respond without requiring deep threat intelligence expertise in-house.

Flare supports healthcare security teams and partners serving healthcare clients to mitigate threats before they become breaches. A free 14-day trial is available with no credit card required.

EDR and XDR tools cover compromises on managed endpoints within your environment. Infostealer malware increasingly infects personal devices, contractor machines, and home workstations, devices your EDR never touches. The credentials harvested from those devices include EHR logins, Imprivata SSO tokens, and billing platform access, and they appear on criminal markets where threat actors purchase them. When an attacker logs into your EHR with a legitimate credential from a device you never managed, there’s no malware signature, no exploit, and no anomalous binary for your EDR to detect. Flare covers the gap between your endpoint perimeter and the criminal markets where those credentials are sold. These are complementary data sources, not competing ones.

Identity exposures represent the clearest path to healthcare breaches and the costly fines that follow. HIPAA breach notification costs alone can run $150 to $500 per affected patient, and failure to notify is its own violation assessed on top of the underlying breach. HIPAA’s proposed 2026 Security Rule updates eliminate the flexibility between “addressable” and “required” controls, compress incident reporting to a 24-hour window for business associates, and introduce a new 72-hour notification requirement for certain security incidents. Flare helps security teams detect compromised credentials before they become breach events, provides nearly a decade of archived cybercrime data for timeline reconstruction when HIPAA’s 60-day notification clock starts, and delivers raw forensic context to support scoping decisions, helping incident response teams determine whether a credential exposure constitutes a reportable breach.

Threat intelligence is important for healthcare security teams because the healthcare sector faces threats that are specifically targeted, high-volume, and operationally invisible until it is too late. Traditional security tools, including firewalls, EDR, and SIEM, detect threats inside the network perimeter. Threat intelligence extends visibility outside it: to dark web forums, Telegram channels, stealer log marketplaces, and cybercrime communities where healthcare credentials are bought and sold before they are weaponized.

The time window matters critically. When a stealer log surfaces on an underground forum, there is typically a period before the attacker acts on the credential. A healthcare organization with active threat intelligence monitoring can identify that exposure, rotate the compromised credential, investigate the affected device, and close the vulnerability, all before patient data is accessed or a ransomware payload is deployed.

Without threat intelligence, healthcare security teams are operating reactively, detecting breaches only after PHI has been accessed, HIPAA obligations have been triggered, and reputational damage is already underway.

The average cost of a healthcare data breach is the highest of any sector. For a CISO making the business case for threat intelligence investment, the calculus is straightforward: the cost of a CTI platform is a small fraction of the cost of a single reportable breach, including breach notification, OCR investigation, remediation, and potential penalties.

For healthcare organizations specifically, dark web monitoring provides a return on investment that is difficult to match with any other single security control. Here is why:

• The exposure is already happening. Our analysis of 154,000+ stealer logs found healthcare credentials actively circulating in underground markets right now. The question for most health systems is not whether their credentials have been exposed, but whether they know about it. 
• The cost of not knowing is a reportable breach. Under HIPAA, unauthorized access to PHI, even if discovered after the fact, triggers breach notification obligations, HHS reporting, and potential OCR investigation. Dark web monitoring creates a window to detect credential exposure before it becomes a reportable incident.

Healthcare-specific ROI factors:

• Average healthcare data breach cost: In the US, the cost was between $9M – $12M in 2025 according to various reports (IBM, AHA), outpacing all other industries
• Average dark web monitoring platform cost: A fraction of that, typically starting in the tens of thousands of dollars annually for an enterprise deployment
• Break-even: A single prevented breach more than offsets years of platform investment
• What it does not do: Dark web monitoring is not a prevention tool, and it does not stop credentials from being stolen by infostealer malware. It is a detection and response tool that shrinks the attacker’s window of opportunity. It works best when integrated with an incident response workflow that acts on alerts quickly.