Cyber Security NSW has said it has been in contact with NSW Police after a hacker claimed to have breached a “misconfigured subdomain” and gained access to an alleged 70 gigabytes of sensitive data.
“Cyber Security NSW is responding to a cyber breach impacting an isolated server within NSW Health,” a spokesperson told Cyber Daily
“The breach has been declared a major incident and is being investigated by the NSW Police Cyber Crime Squad.
“No patient data has been impacted at this time nor is any patient data currently at risk from this limited cyber breach.
“As this is a criminal investigation, no further comment is available.”
The alleged data has been shared on a popular underground hacking forum, alongside sample data and links to the entire dataset. The hacker – who calls themselves bytetobreach – says the data dates from the “covidian era” to 2026.
“A full intrusion into the rest of the network was prevented when I accidentally crashed the server,” the hacker said in a November 3 post.
“No ransom is asked from anyone affiliated with the government of Australia, and I have already sent a quick notification to the CERT’s team (ACSC / AUSCERT).”
Kash Sharma, Managing Director APAC at cyber security firm BlueVoyant said that while the incident only impacts an "isolated server," the word 'isolated' is worthy of scrutiny, "because in a large health system few things are truly standalone."
"Servers connect to vendors, contractors, managed service providers and shared platforms, and each of those connections is a potential pathway in or out," Sharma told Cyber Daily.
“What this incident shows is that early reassurance is only as good as an organisation’s visibility into what is actually connected to what. Health systems manage thousands of external relationships, and when something goes wrong, the first question is always how far the exposure extends.
"Organisations that can answer that quickly are the ones that have mapped their ecosystem in advance, not those that start working it out after an incident is declared.”
UPDATED 04/11/26 to add BlueVoyant commentary.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
