100,000 documents stolen from ‘isolated’ NSW Health server

Cybercrime detectives are probing an alleged data breach as a hacker claims they accessed about 100,000 sensitive documents from NSW Health before crashing its server.

Cyber Security NSW said no patient data has been impacted by the “limited” breach, a spokesperson saying it impacted an “isolated server” within NSW Health.

“No patient data has been impacted at this time nor is any patient data currently at risk,” they said.

NSW Police cybercrime detectives were notified about the alleged breach about 1pm on Friday.

In a screenshot of a dark web forum post – shared by Dubai-based cyber threat intelligence platform Hackmanac early on Wednesday – a user calling themselves “bytetobreach” said they have accessed “around 100,000 sensitive documents from Australia’s NSW public health systems”.

“Threat actor bytetobreach claims to have compromised NSW Health systems by exploiting a misconfigured subdomain, allegedly exfiltrating approximately 70GB of data comprising 100,000 sensitive documents dating from 2020 onwards,” Hackmanac said on social media.

The documents – dating back as far as 2020 – were “snatched from a misconfigured subdomain” according to the forum post.

“A full intrusion into the rest of the network was prevented when I accidentally crashed the server,” bytetobreach wrote.

“No ransom is asked from anyone affiliated with the government of Australia, and I have already sent a quick notification to the [Computer Emergency Response Team].”

Hackmanac noted the claim is “pending verification”.

Senior government minister John Graham told ABC Radio Sydney the breach serves as a reminder that cybersecurity “is an increasingly difficult area”.

Get alerts on breaking news as it happens. Sign up for our Breaking News Alert.