November 3–4, 2026: Cyber Security NSW confirmed a breach of "an isolated server within NSW Health", reported to be the Oral Health Fee For Service Scheme website. NSW Police say about 4GB of data was taken, mainly personal details of dentists and other third-party health providers. NSW Health says no patient data was affected. A hacker calling themselves bytetobreach claims far more: about 70GB. The catalog entry records both accounts.
What happened
The NSW Police State Crime Command's Cybercrime Squad was alerted at about 1pm on Friday, October 30, 2026. The incident was declared a major incident under the state's cyber security emergency plan, and detectives opened an investigation under Strike Force Civic, working with NSW Health and Cyber Security NSW. eHealth NSW chief executive Richard Taggart said security alerts fired automatically and the site was taken down by hand. Police Commander Matt Craft said the people responsible appear to be outside Australia.
The Oral Health Fee For Service Scheme pays private dentists to treat public patients, which explains why the stolen details relate mainly to providers rather than patients.
The hacker's claims
On November 3, a forum user calling themselves bytetobreach posted screenshots and download links. They claim to have entered through a misconfigured health.nsw.gov.au subdomain and taken about 70GB, roughly 100,000 documents from 2020 onwards. They say a wider intrusion stopped when they accidentally crashed the server, that they are not demanding a ransom, and that they told the Australian Cyber Security Centre and AUSCERT.
Verified and unverified
- Confirmed by officials: a breach of an isolated NSW Health server; the police investigation under Strike Force Civic; police's estimate of about 4GB taken, mostly identification details of dentists and other providers; and NSW Health's statement that no patient data or clinical services were affected and no other agencies were hit.
- Unverified: the 70GB and 100,000-document figures, the 2020-onwards date range, and the claim that patient material is included. The police and hacker figures differ by more than ten times, and officials have not addressed the gap.
Security consultant Kash Sharma of BlueVoyant questioned how "isolated" any server in a large health system can be, saying the real exposure depends on how well the organisation understands its vendor and platform connections.
Who is at risk
Dentists and dental practices enrolled in the scheme are the people most likely to be affected. Identification details can be used for impersonation, fraudulent registration changes or targeted phishing. Patients have been told their data was not involved, but scammers are already using the news. Callers posing as NSW Police cybercrime detectives or a "data recovery team" have asked people for remote access to their computers to "check for the leaked files."
What to do
- If you are a provider in the Oral Health Fee For Service Scheme, watch for a notice from NSW Health and be cautious with unexpected emails about payments, registration or bank details.
- Never give remote access to anyone who calls about the breach. Police and NSW Health will not ask for it. Hang up and call back on an official number.
- Do not download the leaked files. Links on hacking forums are a common way to spread malware.
- If you are worried about identity misuse, IDCARE (1800 595 160) offers free support in Australia.
- Check the ID Support NSW data breach page for official updates.
This is the second NSW government body in the catalog this autumn, after a Clop leak-site claim against Transport for NSW in September, which remains unverified.
Sources
- Medical Republic, "Police investigating NSW Health cyber breach," November 4, 2026
- Cyber Daily, November 4, 2026
- Information Age (ACS), "Hacker claims 100,000 documents stolen from NSW Health"
Sourcing note: the website name and the 4GB figure come from Medical Republic's report of the police and NSW Health briefing. The 70GB figure is the hacker's own and has not been verified.