2026 NSW Health — Oral Health Fee For Service Scheme website breached; police say about 4GB taken, mostly dentists' details (actor claims 70GB)

2026 Unknown records affected

Data compromised

Police believe about 4GB was stolen, consisting largely of personal identification information about dentists and other third-party health providers. NSW Health says no patient data was affected and none is currently at risk. The actor claims about 70GB, or roughly 100,000 documents from 2020 onwards; that figure is unverified.

Technical writeup

eHealth NSW says security alerts were automatic but the site was taken down manually. The actor says no ransom was demanded and that it told ACSC and AUSCERT. Scam calls from people posing as police or a "data recovery team" have been reported.

Root cause

Cyber Security NSW confirmed a breach of "an isolated server within NSW Health", which Medical Republic reports was the Oral Health Fee For Service Scheme website. NSW Police were alerted at about 1pm on October 30, 2026; the incident was declared a major incident and the State Crime Command Cybercrime Squad is investigating under Strike Force Civic. Police say those responsible appear to be outside Australia. A forum user calling themselves bytetobreach claims to have entered through a misconfigured health.nsw.gov.au subdomain and says a wider intrusion stopped when the server crashed.

Data compromised

Technical writeup

Root cause

References

Breaches you may like