Science & Tech · Cybersecurity · 2 hrs ago
NSW Health investigates breach of isolated server
A cybersecurity breach affected an isolated NSW Health server in New South Wales, Australia.
Police are investigating after being alerted on Friday, and officials have declared the breach a major incident.
A user on a dark web forum claimed to have taken about 100,000 sensitive documents, but that claim has not been verified.
The documents were said to date from 2020, and officials say no patient data has been affected or is currently at risk.
Health Minister Ryan Park said police delayed public notice while they considered the timing during a live investigation.
The breach has raised concerns about the need for agencies to strengthen their cybersecurity systems.
Police, NSW Health and Cyber Security NSW were expected to address the media later that day, while the investigation continued.
NSW Police are investigating a cybersecurity breach involving an isolated NSW Health server, which officials have declared a major incident.
Cyber Security NSW said no patient data had been affected or was currently at risk.
A hacker claimed to have accessed about 100,000 sensitive documents, but the claim is pending verification.
Health Minister Ryan Park said the incident was not made public earlier because police wanted to decide when to announce it.
Officials said the investigation is ongoing and that the situation could change.
- Who
- NSW Health and NSW Police are involved. A hacker using the name “bytetobreach” claimed responsibility for accessing documents.
- What
- A suspected cyber breach affected an isolated NSW Health server. The hacker claimed to have accessed about 100,000 sensitive documents.
- When
- Police were alerted about 1pm on Friday. The breach was reported publicly on Wednesday, November 4, 2026.
- Where
- An isolated server within NSW Health in New South Wales, Australia.
- Why
- The hacker claimed to have exploited a misconfigured subdomain. The reason for the attack is not stated.
The hacker “bytetobreach
NSW officials
Access to documents
The hacker “bytetobreach
The hacker claimed to have accessed about 100,000 sensitive documents.
NSW officials
Officials said the breach affected an isolated server; the hacker’s claim is pending verification.
Patient data
The hacker “bytetobreach
The hacker’s post described accessing sensitive documents but did not specify whether they included patient data.
NSW officials
Cyber Security NSW said no patient data had been impacted or was currently at risk.
NSW Police cybercrime detectives were alerted to the suspected breach.
Health Minister Ryan Park said he was made aware of the breach.
The breach was reported publicly, with officials saying police were investigating.
- Affected system
- An isolated NSW Health server
- Police investigation
- Strike Force Civic, led by NSW Police cybercrime detectives
- Documents claimed accessed
- About 100,000 sensitive documents
- Data volume claimed
- Approximately 70GB
- Documents’ date range
- 2020 onwards
- Claimed hacker
- bytetobreach
4 sources
What people are saying
The breach has been declared a major incident.
They wanted to determine when that goes public
A full intrusion into the rest of the network was prevented when I accidentally crashed the server
It is getting more difficult, there's no question about that
Posts on X
🚨Cyber Alert ‼️ 🇦🇺Australia - 𝗡𝗦𝗪 𝗚𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 𝗛𝗲𝗮𝗹𝘁𝗵 Threat actor bytetobreach claims to have compromised NSW Health systems by exploiting a misconfigured subdomain, allegedly exfiltrating approximately 70 GB of data comprising 100,000 sensitive documents