Short answer
NSW Health reported unauthorised access to a website for its Oral Health Fee For Service Scheme on 29 October 2026, and Cyber Security NSW declared a major incident. Police say about 4GB of provider data was taken and suspects are believed to be overseas. A forum poster claims 100,000 documents, which has not been verified.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | NSW Health |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Public health |
| Country | Australia |
| Detected | 2026-10-29 |
| Disclosed | 2026-11-04 |
| People or records affected | Authorities say details of third-party health providers, mainly dentists, and about 4GB of data. A forum poster claims about 100,000 documents, which is unverified |
What data was exposed
- Personal identification information of third-party health providers, mainly dentists, per NSW Police
- A 'small number of details' for providers that eHealth NSW described as potentially sensitive
- NSW Health and Cyber Security NSW say no patient data was affected
What happened
On 29 October 2026, NSW Health reported unauthorised access to a single website, the Oral Health Fee For Service Scheme, which gives eligible patients subsidised dental treatment through third-party providers, according to the ABC. NSW Police say the Cybercrime Squad was alerted around 1pm on Friday 30 October and opened an investigation under Strike Force Civic. The news became public on 4 November, when Cyber Security NSW said the breach affected an isolated NSW Health server and declared it a major incident.
What authorities say was taken
NSW’s chief cyber security officer, Marie Patane, said no patient information was affected and no clinical services were at risk. eHealth NSW chief executive Richard Taggart said a small number of details for third-party health providers were affected and could be sensitive. Police said the breach involved a significant amount of personal identification information belonging to those providers, mainly dentists, and that they believe about 4GB of data was stolen. No other NSW agencies were affected.
The hacker’s claim
Separately, a threat actor calling itself bytetobreach claimed on a forum that it took about 100,000 NSW Health documents, roughly 70GB, through a misconfigured subdomain. Information Age reported that the threat intelligence firm Hackmanac called it pending verification. Police have not confirmed that this person carried out the breach or that these figures are right, and police said the claims online are being monitored. This is a claim, not a finding. The gap between 4GB and 70GB is one of the open questions.
Investigation
Detective Superintendent Matt Craft said the matter has an international element and that suspects are believed to be outside Australia. The AFP is assisting, and police are liaising with the FBI and the US Department of Homeland Security. Police will also look into any identity crimes arising from the data.
What this means for providers and patients
The people most exposed are dentists and other providers in the scheme, whose identity details may now be in criminal hands. Expect convincing phishing that mentions scheme payments or portal logins. Patients are not told to take action, but should ignore any message claiming their health records leaked. Start with our data breach checklist, and read how scammers pose as agencies in our guide to government impersonation scams. Provider-targeted lures are covered in fake invoice and business email scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails or calls to dentists and other providers that quote real practice details and ask them to 'verify' logins or banking.
- Identity fraud using provider personal details, which NSW Police say they will look into.
- Fake 'NSW Health breach' messages sent to the public asking for payment or card details.
What to do if you are affected
- 01If you are a provider in the dental voucher scheme, treat unexpected contact about the scheme, payments or logins as suspect and call back on a number you look up yourself.
- 02Change passwords for any scheme or portal account and turn on multi-factor authentication.
- 03Watch bank and tax records for changes and consider a credit ban or alert through the credit bureaus.
- 04Report identity misuse to IDCARE or ReportCyber, and contact NSW Health through its official channels with questions.
- 05Patients should ignore messages claiming their health data was leaked, since NSW Health says patient data was not affected.
Frequently asked questions
Was patient data stolen from NSW Health?
NSW Health and Cyber Security NSW say no patient data has been affected and none is at risk from this limited breach. Police say the data involved belongs mainly to third-party providers such as dentists.
What is the 100,000 documents claim?
A poster using the name 'bytetobreach' claimed on a hacking forum to have taken about 100,000 documents, roughly 70GB, through a misconfigured subdomain. Information Age said the claim was pending verification, and police have not confirmed it. Police believe about 4GB was taken.
Has a ransom been demanded?
Police told reporters they had received no demands or threats related to the data, and the forum poster made no ransom demand.
Who is investigating?
The NSW Police Cybercrime Squad under Strike Force Civic, with NSW Health and Cyber Security NSW. Police said the Australian Federal Police are assisting and that suspects are believed to be outside Australia.
Sources
- Police investigate cybersecurity breach of NSW Health's Oral Health Fee For Service Scheme website, ABC News, 2026-11-04
- Hacker claims 100,000 documents stolen from NSW Health, Information Age (ACS), 2026-11-04
- Major incident: criminal investigation under way after NSW Health data breach, The Nightly, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.