Officials say the breach is a ‘major incident’ involving third-party providers but say patient data has not been compromised.
Cybercrime detectives are investigating a “major” data breach of a NSW Health website involving a “significant” amount of information relating to third-party health providers.
The cyber breach has been declared a “major incident” and NSW Police have launched a criminal investigation.
But experts say no patient data or clinical service has been compromised
NSW Police said they believe around 4GB of data was stolen from the NSW Health Oral Health Fee For Service Scheme website.
The State Crime Command’s Cybercrime Squad was alerted to the alleged data breach at NSW Health at 1pm on Friday 30 October.
“Detectives have commenced an investigation under Strike Force Civic and are working closely with NSW Health and Cyber Security NSW,” NSW Police said in a statement.
“Investigations are ongoing.”
Chief executive of eHealth NSW, Richard Taggart, said a small number of details for third-party health providers were impacted by the breach on the Oral Health Fee For Service Scheme website.
Mr Taggart said the information was potentially sensitive.
“The alerts that came through from our cybersecurity systems were automatic, but the site was taken down manually,” Mr Taggart told media today.
Related
NSW chief cyber security officer Marie Patane said the incident was classified as “major” after meeting the criteria outlined in the NSW Cyber Security Incident Emergency Sub Plan.
She said no patient data had been compromised and no clinical services were at risk. No other NSW government agencies had been affected, she said.
NSW Police Cyber Crime Squad Commander Detective Superintendent Matt Craft said the breach involved a “significant amount of personal identification information” related to the third-party health providers, mainly dentists.
“It’s obvious to us at this stage that it’s people that are outside Australia,” Superintendent Craft said.
“This is a serious criminal offence where data has been taken.
“It’s not an AI-related breach – it’s an individual who has engaged in unlawful conduct.”
NSW health minister Ryan Park said he was made aware of the cyber attack in “the last couple of days”.
“Police made it clear that given it is a live investigation, they wanted to determine when that [news] goes public,” Mr Park told media this morning.
Mr Park said no patient data had been impacted and no service had been compromised.
“I also hasten to say we are in a live investigation, so things can and may and often do in this type of incident change,” he said.
“We have very robust cybersecurity systems in place.”
Cyber Security NSW said it was responding to a cyber breach impacting an isolated server within NSW Health.
“The breach has been declared a major incident and is being investigated by the NSW Police Cybercrime Squad,” a spokesperson said.
“No patient data has been impacted at this time nor is any patient data currently at risk from this limited cyber breach.
“As this is a criminal investigation, no further comment is available.”
A Dubai-based cyber threat intelligence platform Hackmanac shared a screenshot of a dark web forum post today by a user called “bytetobreach”.
“Threat actor bytetobreach claims to have compromised NSW Health systems by exploiting a misconfigured subdomain, allegedly exfiltrating approximately 70GB of data comprising 100,000 sensitive documents dating from 2020 onwards,” Hackmanac posted on the social media platform formerly known as Twitter.
The screenshot said they had accessed “around 100,000 sensitive documents from Australia’s NSW public health systems, snatched from a misconfigured subdomain (health.nsw.gov.au)”.
“The unredacted documents start from the covidian era onward till 2026, totalling around 70Gb’s,” bytetobreach said.
“A full intrusion into the rest of the network was prevented when it accidently crashed the server, which would require a manual restart.
“No ransom is asked from anyone affiliated with the government of Australia, and I have already sent a quick notification to the CERT’s team (ACSC / AUSCERT).”
