Australian Police Investigate Major NSW Health Cyber Breach as Hacker Claims 70GB Data Theft

Australian authorities are investigating a cyberattack involving an isolated NSW Health server after a hacker claimed to have obtained approximately 70 gigabytes of sensitive information.

Cyber Security NSW confirmed on November 4 that the incident had been classified as major and referred to the New South Wales Police Cyber Crime Squad for investigation.

The alleged attacker, using the name "bytetobreach," claimed to have exploited a misconfigured subdomain and accessed approximately 100,000 documents. The individual reportedly posted sample material and links to the alleged dataset on an underground hacking forum.

However, the claimed volume of stolen information and the full extent of the intrusion have not been independently verified.

NSW Health maintained that patient information had not been compromised and was not considered at risk at the time of its statement.

The incident reportedly involved infrastructure associated with the state's Oral Health Fee For Service Scheme, which connects eligible patients with participating private dental providers.

For digital forensic investigators, establishing the actual scope of the breach will require examining server logs, authentication records, network activity, and any available evidence of data transfers.

Investigators must also determine whether the attacker accessed only the affected server or attempted to move into other connected systems.

The case highlights an important distinction in cybercrime investigations: an attacker claiming to possess information does not necessarily establish how much data was accessed, copied, or successfully removed.

Evidence preservation will be particularly important because compromised infrastructure may contain temporary logs and other artifacts that could disappear during recovery operations.

Authorities have not publicly confirmed the attacker's identity, the complete intrusion method, or the final quantity of exposed information.

The investigation remains ongoing, with forensic examination expected to play a central role in determining what actually happened.