Private dental providers, not patients, may be the people exposed by a breach of a NSW Health server that has been declared a major incident.
The server held data for the Oral Health Fee for Service Scheme, which lets the public dental service issue vouchers for treatment by private practitioners. The detail was reported by AAP.
eHealth NSW chief executive Richard Taggart said no patient data was involved, but a small number of third-party provider records may have been stolen. He said the stolen data could involve sensitive documents.
eHealth is looking to notify private dental providers who may be affected. The report did not say whether any notifications had been sent.
That account sits uneasily with claims made on an underground hacking forum. A user calling themselves bytetobreach claimed to have taken about 70GB, or around 100,000 sensitive documents, by exploiting a misconfigured subdomain.
"A full intrusion into the rest of the network was prevented when I accidentally crashed the server," the user wrote in a 3 November post, Cyber Daily reported.
Threat intelligence platform Hackmanac, which shared a screenshot of the post, listed the claim as pending verification. The user said the documents dated from 2020 onwards and that no ransom was being sought.
NSW Health detected the breach when an automatic system flagged unusual traffic on a remote health server. The site was taken down manually within about three hours.
NSW Police said the State Crime Command's Cybercrime Squad was alerted at about 1pm on Friday 30 October. Detectives are investigating under Strike Force Civic with NSW Health and Cyber Security NSW.
Offshore Focus
Detective Superintendent Matt Craft, commander of the Cybercrime Squad, said investigators were looking overseas.
Police will work with international partners, including the FBI, if a suspect is identified overseas. Craft said the online posts would form part of the investigation, but police "also need to test the veracity of that information".
Cyber Security NSW described a limited breach of an isolated server. "No patient data has been impacted at this time nor is any patient data currently at risk from this limited cyber breach," a spokesperson said.
Kash Sharma, managing director APAC at BlueVoyant, said the word isolated deserved scrutiny "because in a large health system few things are truly standalone".
"Servers connect to vendors, contractors, managed service providers and shared platforms, and each of those connections is a potential pathway in or out," Sharma told Cyber Daily.
A Run of Incidents
Strike Force Civic has handled several matters involving NSW agencies this year. In April, a NSW Treasury staff member was charged after an alleged data breach that led the government to declare a significant cyber incident.
In July, a NSW Health nurse was charged after allegedly downloading patient data without authorisation. In 2025, documents belonging to nearly 600 medical staff were exposed through a website configuration problem.
In September, NSW Health denied a claim by the MedusaLocker ransomware group, saying it could find no evidence its systems had been affected.
The latest incident follows the OAIC's report of a sevenfold jump in breaches affecting more than one million people in 2025-26.