Cybercrime detectives are probing an alleged data breach as a hacker claims they accessed 100,000 sensitive documents from NSW Health before crashing its server.
Cyber Security NSW said no patient data has been impacted by the “limited” breach, a spokesperson saying it impacted an “isolated server” within NSW Health.
“No patient data has been impacted at this time nor is any patient data currently at risk,” they said.
NSW Police cybercrime detectives were notified the alleged breach 1pm on Friday.
Health Minister Ryan Park said authorities were made aware of the issue in “the last couple of days”, but said it was not made public due to the police investigation.
“They wanted to determine when that goes public,” Park said.
But in a screenshot of a dark web forum post – shared by Dubai-based cyber threat intelligence platform Hackmanac early on Wednesday – a user calling themselves “bytetobreach” said they had accessed “around 100,000 sensitive documents from Australia’s NSW public health systems”.
“Threat actor bytetobreach claims to have compromised NSW Health systems by exploiting a misconfigured subdomain, allegedly exfiltrating approximately 70GB of data comprising 100,000 sensitive documents dating from 2020 onwards,” Hackmanac said on social media.
The documents – dating back as far as 2020 – were “snatched from a misconfigured subdomain” according to the forum post.
“A full intrusion into the rest of the network was prevented when I accidentally crashed the server,” bytetobreach wrote.
“No ransom is asked from anyone affiliated with the government of Australia, and I have already sent a quick notification to the [Computer Emergency Response Team].”
Hackmanac noted the claim is “pending verification”.
Park said he had been advised no patient data or information has been compromised and no risk to clinical services has been identified, but noted it remains a “live investigation”.
“Things can and may, and often do in this type of incident, change,” Park said.
He said the government has “very robust cybersecurity systems in place” but they will continue to be challenged by hackers.
“This is an evolving criminal activity that changes all the time,” Park said.
“We will need to constantly look at what we’re doing in this space, how to strengthen and harden up our systems and controls.”
You have reached your maximum number of saved items.
Remove items from your saved list to add more.
No gift articles left
You've used all of your gift articles. 3 more will become available on the 1st of every month.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
