Hacker claims 100000 documents stolen from NSW Health - Information Age

A hacker claims to have accessed 100,000 sensitive documents from NSW Health after allegedly hacking into one of the department’s servers, causing it to crash.

In a post on an underground hacking forum, threat actor ‘bytetobreach’ claimed to have “snatched” some 70GB of unredacted documents by exploiting a misconfigured subdomain.

According to threat intelligence outfit Hackmanac , bytetobreach published alleged evidence of the data breach which included screenshots and numerous file-sharing links.

The threat actor further claimed that a “full intrusion” into the rest of the targeted network was thwarted when they mistakenly crashed a server they were targeting.

“The unredacted documents start from the covidian era onward till 2026 [sic],” they wrote.

Hackmanac noted the alleged breach was “pending verification”, while Cyber Security NSW has confirmed investigations into a “cyber breach” are under way.

Patient data unaffected as authorities investigate

Bytetobreach did not specify what information was contained in the allegedly stolen documents.

However, a Cyber Security NSW spokesperson confirmed to Information Age that no patient data had been affected.

“Cyber Security NSW is responding to a cyber breach impacting an isolated server within NSW Health,” a spokesperson said.

“No patient data has been impacted at this time nor is any patient data currently at risk from this limited cyber breach.”

The spokesperson confirmed the breach had been declared a “major incident” under investigation by the NSW Police Cyber Crime Squad.

Information Age asked whether any staff data was at risk but was told no further was available given the matter is undergoing a criminal investigation.

NSW Police meanwhile confirmed the State Crime Command's Cybercrime Squad was alerted to the alleged data breach at 1pm on Friday.

“Detectives have commenced an investigation under Strike Force Civic and are working closely with NSW Health and Cyber Security NSW,” police told Information Age .

“Investigations are ongoing.”

Hacker makes no ransom demand

Despite publishing screenshots and links relating to the allegedly compromised data, bytetobreach has not demanded a ransom.

“No ransom is asked from anyone affiliated with the government of Australia,” they wrote.

Craig Costello, professor in the School of Computer Science at Queensland University of Technology (QUT), said hackers could seek recognition within their communities rather than financial rewards.

“Bragging rights” could be a currency in their own right in hacking circles, he explained.

“Publicising a breach can build a reputation, push a political message, or simply embarrass the target,” said Costello.

“Sometimes attention is part of the payoff.

“Those are well-established motives generally, but they don’t establish the motive here.”

Costello cautioned the absence of a ransom demand did not rule out a financial motive, or the possibility that one could be made later.

He also warned against taking claims made on hacking forums at face value, saying they needed to be independently investigated.

“The number of documents, how sensitive they are and whether that person actually crashed the server all need independent verification,” said Costello.

Gowri Ramachandran, senior lecturer in the School of Information Systems at QUT, said Australians should remain concerned cybersecurity incidents affecting essential public services, even when there is no evidence that sensitive personal information has been compromised.

“The absence of confirmed data exposure does not mean there is no cybersecurity risk,” said Ramachandran.

“Although NSW Health is confident that patient data has not been affected, the incident raises broader security questions, particularly how attackers gained access to the system.”

The alleged breach follows data security incidents involving NSW Health.

In July, a former employee was charged for allegedly downloading patient records without authorisation .

Another incident in 2025 saw the data of nearly 600 medical staff exposed after confidential documents were mistakenly left publicly available online.