NSW Health investigates alleged theft of 100,000 sensitive documents

Cybercrime detectives are investigating an alleged data breach involving NSW Health in Australia. A hacker using the name “bytetobreach” claims to have accessed approximately 100,000 sensitive documents, totaling roughly 70GB of data, dating back to 2020.

The threat actor reportedly exploited a misconfigured subdomain to exfiltrate the files before accidentally crashing the server, which allegedly prevented a full intrusion into the rest of the network. The hacker stated that no ransom is being requested and that a notification was sent to the Computer Emergency Response Team.

Cyber Security NSW has described the incident as a “limited” breach of an isolated server. Officials, including Health Minister Ryan Park, stated that no patient data has been impacted at this time and no patient information is currently at risk.