NSW Health Breach Declared a Major Incident as Police Look Offshore

NSW Police have declared a major cyber incident after an attack on a NSW Health server, and detectives say they are now looking overseas for whoever is behind it. The breach hit the website behind the Oral Health Fee For Service Scheme, and while officials insist no patient data was involved, a small number of private dental providers may have had their details stolen.

A hacker has since claimed a far larger haul than police accept, and that gap is now part of the investigation. Here is what is confirmed, what is claimed, and what remains unknown.

What happened to the NSW Health server

NSW Health detected the breach when an automatic system flagged unusual traffic on a remote health server. Staff took the affected site down manually within about three hours, according to reports of the incident.

The affected system is the website behind the Oral Health Fee For Service Scheme. The scheme lets the public dental service issue vouchers so patients can get treatment from private practitioners. The data on that server relates to providers in the scheme, not to hospital patients.

Cyber Security NSW described the incident as a limited breach of an isolated server. In a statement carried by several outlets, a spokesperson said: "No patient data has been impacted at this time nor is any patient data currently at risk from this limited cyber breach."

NSW Police said the State Crime Command's Cybercrime Squad was alerted at about 1pm on Friday 30 October. Detectives are investigating under Strike Force Civic, working with NSW Health and Cyber Security NSW. The formal declaration of a major incident followed on Wednesday 4 November.

What police say was taken

The confirmed picture, as described by officials, is narrow. Police believe about 4 GB of data was stolen. eHealth NSW chief executive Richard Taggart said no patient data was involved, but a small number of third-party provider records may have been stolen. He said the stolen data could involve sensitive documents.

eHealth is looking to notify private dental providers who may be affected. Reports did not say whether any notifications had yet been sent. After a breach becomes public, scammers often send fake messages pretending to be the affected organisation, so anyone contacted about this incident should check it through official NSW Health channels rather than clicking a link in a text or email.

The hacker's much larger claim

A very different account has appeared on an underground hacking forum. A user calling themselves bytetobreach claimed to have taken about 70 GB of data, or around 100,000 sensitive documents, by exploiting a misconfigured subdomain. The user said the documents dated from 2020 onwards and that no ransom was being sought.

In a post dated 3 November, the user wrote: "A full intrusion into the rest of the network was prevented when I accidentally crashed the server."

Threat intelligence platform Hackmanac shared a screenshot of the forum post and listed the claim as pending verification. NSW Police rejected the 70 GB figure, and nobody has verified the document count. The 100,000-document claim remains unconfirmed.

Detective Superintendent Matt Craft, commander of the Cybercrime Squad, said investigators were looking overseas. Police will work with international partners, including the FBI, if a suspect is identified overseas. Craft said the online posts would form part of the investigation, but police "also need to test the veracity of that information".

Is an isolated server really isolated

Cyber Security NSW has stressed that the breach was limited to an isolated server. Kash Sharma, managing director APAC at security firm BlueVoyant, said the word isolated deserved scrutiny "because in a large health system few things are truly standalone".

"Servers connect to vendors, contractors, managed service providers and shared platforms, and each of those connections is a potential pathway in or out," Sharma told Cyber Daily.

Nothing published so far shows the attacker moved beyond the one server, and officials have described the breach as limited.

A run of incidents at NSW Health

The breach is the latest in a run of incidents involving NSW agencies this year. Strike Force Civic has handled several matters involving NSW agencies. In April, a NSW Treasury staff member was charged after an alleged data breach that led the government to declare a significant cyber incident. In July, a NSW Health nurse was charged after allegedly downloading patient data without authorisation. In 2025, documents belonging to nearly 600 medical staff were exposed through a website configuration problem.

The pattern is not unique to New South Wales. The privacy regulator reported a sevenfold jump in breaches affecting more than one million people in 2025-26. Health data is a frequent target because it is detailed, hard to change, and valuable to criminals who trade in identity fraud.

What happens next

The investigation is now in the hands of Strike Force Civic, and the offshore focus suggests detectives believe the people behind the breach are outside Australia. That can make an investigation slower, because it depends on cooperation with overseas police and on the forum evidence holding up under scrutiny.

For private dental providers in the Oral Health Fee For Service Scheme, the practical step is simple: watch for a notification from eHealth NSW, and be wary of any message that claims to be about the breach and asks for personal details or payment.

Frequently Asked Questions

Was patient data stolen in the NSW Health breach?

According to officials, no. NSW Health and Cyber Security NSW have both said no patient data has been impacted, and eHealth NSW chief executive Richard Taggart said no patient data was involved. The records possibly stolen belong to a small number of third-party providers, mainly private dentists in the Oral Health Fee For Service Scheme.

How much data did the hacker claim to steal?

A forum user calling themselves bytetobreach claimed about 70 GB of data, or around 100,000 sensitive documents, taken by exploiting a misconfigured subdomain. NSW Police put the figure at about 4 GB and rejected the larger claim. The document count has not been verified, and threat intelligence firm Hackmanac listed the claim as pending verification.

What should dental providers in the scheme do now?

Providers should watch for direct contact from eHealth NSW about whether their records were affected. They should also be alert to scam messages that use the breach as a cover story, and check anything suspicious through official NSW Health channels rather than clicking links in a text or email.