NSW Police cybercrime detectives are investigating an alleged data breach at NSW Health. A hacker using the name "bytetobreach" says they took about 100,000 sensitive documents, roughly 70GB, from a misconfigured NSW Health web subdomain and then accidentally crashed the server. Cyber Security NSW has declared it a major incident. It says the breach was "limited" to an isolated server and that "no patient data has been impacted at this time nor is any patient data currently at risk." Officials have not confirmed how many documents were taken, how much data, or what kind. Those figures come only from the hacker's own forum post. Threat intelligence platform Hackmanac, which first spread the post, describes the claim as "pending verification."
What Happened
NSW Police say the State Crime Command's Cybercrime Squad was alerted to an alleged data breach at NSW Health at about 1pm on Friday, 30 October 2026, according to statements reported by the ABC, SBS (via AAP) and Insurance Business. Detectives are running the investigation under Strike Force Civic, working with NSW Health and Cyber Security NSW. Cyber Security NSW leads the state government's response to significant cyber incidents. NSW Health has sent media questions to police.
The incident became public on Wednesday, 4 November. Health Minister Ryan Park said he was told about the breach in "the last couple of days" and that it had been kept quiet at the request of police. "Police made it clear that given it is a live investigation, they wanted to determine when that [news] goes public," he told reporters, as reported by the ABC and the Sydney Morning Herald. Park said he did not know who was behind the attack and had been advised there was no risk to clinical services.
The public picture comes mainly from a post on a dark web forum. The thread, posted under the handle "bytetobreach33", is dated Tuesday, 3 November. Early on Wednesday, Dubai-based Hackmanac shared a screenshot of it on social media. The thread is labelled "SELLING", yet the author writes that "no ransom is asked from anyone affiliated with the government of Australia." The account joined the forum in June 2026 and has a reputation score of zero.
The timing does not quite line up. Police were alerted on 30 October, several days before the forum post. The hacker says they sent "a quick notification" to Australia's CERT teams (the ACSC and AusCERT). Neither organisation has said whether it received that message or whether it was how authorities found out about the breach.
NSW Transport Minister John Graham called the incident a "big reminder about the importance of cyber security." He said that "whether you're in government or in a private company or just as a citizen, it is an increasingly difficult area."
What Was Taken
Official accounts and the hacker's claims are far apart here, and they cannot yet be reconciled:
- Official position: Cyber Security NSW says one isolated server was affected and no patient data was impacted or is at risk. It has not said what the server held or whether any data was taken from it.
- Hacker's claim: The forum post says "around 100.000 sensitive documents" were taken, totalling "around 70Gb's", unredacted, and dating "from the covidian era onward till 2026." Hackmanac read that as 2020 onwards. The post links to what it calls six "backup" copies on public file-sharing services.
The hacker's claim of "sensitive documents" and the government's statement that no patient data was involved can both be true. The server could have held administrative, operational or staff records rather than clinical ones. Authorities have not said either way. Until NSW Health or Cyber Security NSW describes what the server contained, readers should treat the 100,000-document and 70GB figures as unverified claims by the hacker.
Why It Matters
Officials say "isolated", but they haven't said "harmless". Saying no patient data was involved is a narrow statement. Documents held by a health department can include staff details, internal communications, contracts and system information. Any of these could be used to target staff with phishing or to plan a deeper attack.
The hacker says they were stopped by accident, not by a defence. The post claims "a full intrusion into the rest of the network was prevented when i accidently crashed the server." If that is true, the attacker was only kept out of the wider network because their own mistake took the server offline.
Who must be told is still an open question. WeDo Legal's guide to Australia's Notifiable Data Breaches scheme explains the federal Privacy Act rules. Covered organisations that suspect a breach must assess it within 30 days. If the breach is likely to cause serious harm to people whose personal information was involved, they must notify the Information Commissioner and those people. Whether any notice is needed here depends on what the server held. That has not been made public.
NSW government systems have been hit before. SBS notes that in March 2025 an account used automation to download more than 9,000 files from NSW JusticeLink, a platform where lawyers, police and businesses upload sworn statements and identity documents.
Public-sector cyber losses land on the state. Insurance Business points out that NSW agencies are covered through the state's own self-insurance scheme, the Treasury Managed Fund (run by icare), rather than commercial cyber insurance. Any cost from this incident will fall on the state.
The Attack Technique
No official body has said how the server was accessed. Everything below comes from the hacker and has not been verified.
- Way in: The forum post says the data was "snatched from a misconfigured subdomain" of health.nsw.gov.au. Hackmanac repeated this description.
- Hints in the screenshots: The post includes three screenshots. Their file names refer to a "WEBSHELL" and to "BIG_IP". A web shell is a malicious script planted on a web server that gives an attacker remote control of it. BIG-IP is F5's family of load-balancing and application-delivery devices. The file names suggest the attacker claims to have planted a web shell and that an F5 BIG-IP device was involved. Neither has been confirmed, and the screenshots have not been publicly verified.
- Server crash: The hacker says their activity crashed the server and that it "would require a manual restart."
This kind of attack has happened elsewhere recently, with no known link to NSW Health. In September 2026, GreyNoise reported on an opportunistic attacker (as summarised by Ampcus Cyber). That attacker broke into a western government's website through a WordPress exploit chain, planted a hidden web shell and a fake administrator account, and stole more than 18,566 records. Separately, Manifold Security reported in September that automated AI agent activity had been systematically pulling data from Australian Institute of Health and Welfare dashboards. Neither report has any known connection to this incident. They show that internet-facing government health and web assets are being probed regularly.
What Organizations Should Do
- Find every subdomain you own. List all subdomains under your organisation's domains, including old project, testing and pandemic-era sites. Shut down anything without a current owner. Misconfigured, forgotten subdomains are the access route the hacker claims to have used here.
- Patch and lock down edge devices. Make sure load balancers and application-delivery devices such as F5 BIG-IP are patched. Keep their management interfaces off the internet and review their configurations. These devices sit in front of many web services and can become a way in when misconfigured.
- Look for web shells. Check web servers for unexpected scripts, recently changed files in web folders, unfamiliar admin accounts, and web server processes starting other programs.
- Watch for large outbound transfers. Set alerts for unusually large uploads from web servers. A 70GB transfer should be noticed long before an attacker's own mistake crashes the server.
- Keep public-facing servers apart from internal networks. Make sure internet-facing servers cannot reach internal systems, so a single compromised server does not lead into the wider network.
- Prepare for breach notification now. Know what data each server holds before an incident, so you can quickly assess whether personal information was exposed and meet the 30-day deadline under the Notifiable Data Breaches scheme, plus any state-level rules that apply.
Sources: NSW Health data breach: Detectives investigate alleged theft of 100... | NSW Police investigate cybersecurity breach impacting isolated serv... | Cybercrime squad investigating 'major' NSW Health data breach SBS... | NSW Health cyber breach puts public sector cover in focus Insuranc... | Notifiable data breaches WeDo Legal | AU Where Ma Kangaroo’s At ? NSW Health | Kapibala WordPress Attack and Data Theft Explained | Rogue agents hit US gov sites and a second Australian dashboard