The state's transport minister has warned that cybersafety is becoming an "increasingly difficult" area to manage.
Published 4 November 2026 10:22am
The cyber breach affected an isolated NSW Health server.
Authorities declared the incident a major cyber event, but confirmed no patient data was compromised.
Specialist cybercrime detectives are investigating after a state health department was targeted in an online attack.
NSW Police confirmed on Wednesday that detectives from the cybercrime squad are investigating an alleged data breach at NSW Health.
" 1pm on Friday, 30 October 2026, State Crime Command's Cybercrime Squad were alerted to an alleged data breach at NSW Health," a NSW Police spokesperson said.
"Detectives have commenced an investigation under Strike Force Civic and are working closely with NSW Health and Cyber Security NSW."
The state's cybersecurity department confirmed the attack is being investigated and has been declared a major incident.
News that makes sense
Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.
"Cyber Security NSW is responding to a cyber breach impacting an isolated server within NSW Health," a spokesperson said.
"No patient data has been impacted at this time nor is any patient data currently at risk from this limited cyber breach."
NSW Transport Minister John Graham said while it was a relief no personal data had been exposed, the incident should be a wake-up call.
"Whether you're in government or in a private company or just as a citizen, it is an increasingly difficult area," Graham told ABC radio.
"This individual incident is, of course, of concern and it is actively being investigated."
State government servers were targeted in March 2025 when an account used automation to download more than 9,000 files from NSW JusticeLink.
The platform allows lawyers, police and businesses to upload sworn statements, identity information and other files for the 400,000-plus court cases filed each year.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
