NSW Health breach declared a major incident; police say suspects are believed outside Australia

Cyber Security NSW has confirmed a breach of an isolated NSW Health server used for the Oral Health Fee For Service Scheme. NSW Health reported unauthorized access on October 29, 2026, and NSW Police were alerted at about 1:00 PM on October 30, 2026. The breach has been declared a major incident, and Cybercrime Squad detectives are investigating under Strike Force Civic. Officials say no patient data has been impacted and no clinical services are at risk, with a small number of third-party provider (dentist) details possibly affected. No affected count has been disclosed, so this item is prepared as a Cybersecurity item and not a Breaches add.

In updates on November 4 and 5, 2026, police said the suspects are believed to be outside Australia, describing an international element to the investigation. A forum user calling themselves bytetobreach has claimed about 100,000 documents and about 70 GB of data. That claim is unverified, no official has confirmed it, and it is not counted in any figure in this item.

Sources: Cyber Daily; Insurance Business; Tech Insider