VULNpocalypse
HighBreach / campaignActive

NSW Health breach: dentist provider details stolen from Oral Health scheme site, police investigating

NSW Health found unauthorised access to its Oral Health Scheme website; about 4GB of dentist provider data was taken and no patient data was affected.

Published
Exploitation
Yes. A public NSW Health website was accessed without authorisation and about 4GB of data was taken; a party has claimed responsibility online (ABC News)

What happened

On 29 October 2026 NSW Health discovered unauthorised access to the Oral Health Fee For Service Scheme (OHFFSS) website, a voucher scheme that lets eligible patients get subsidised dental treatment from third-party providers (ABC News). Cyber Security NSW described the affected system as “an isolated server within NSW Health” and said the breach “has been declared a major incident” (SBS News). NSW Chief Cyber Security Officer Marie Patane said it met the triggers in the state’s emergency cyber sub-plan, and that no other NSW government agencies were affected (ABC News).

What data and whose. Richard Taggart, chief executive of eHealth NSW, said a “small number of details for third party health providers” was affected and described the information as “potentially” sensitive (ABC News). Detective Superintendent Matt Craft said the breach involved a “significant amount of personal identification information” about third-party providers, namely dentists, and police estimate about 4GB of data was taken (ABC News). Taggart said automatic alerts from cybersecurity systems came through and the site was then taken down manually (ABC News).

Patient data. Marie Patane said: “There is no impact to patient information, no [patient] data has been compromised and no clinical services are at risk” (ABC News). A Cyber Security NSW spokesperson separately said “No patient data has been impacted at this time” (SBS News).

Timeline:

  • 29 October 2026: NSW Health reported discovering unauthorised access to the website (ABC News).
  • About 1pm, Friday 30 October 2026: the State Crime Command’s Cybercrime Squad was alerted to an “alleged data breach at NSW Health” (Insurance Business).
  • 4 November 2026: NSW Police confirmed the investigation. Health Minister Ryan Park said he was first told “in the last couple of days,” and police asked that the timing of public disclosure be coordinated with the investigation (ABC News).

The investigation. NSW Police’s Cybercrime Squad is leading the investigation under Strike Force Civic, working with NSW Health and Cyber Security NSW (ABC News). The Australian Federal Police are assisting, and police are in contact with the FBI and the US Department of Homeland Security; police will also look into any identity crimes (ABC News).

Attribution: not confirmed. No suspect has been named. Detective Superintendent Craft said the suspect appears to be outside Australia, that the investigation has an international element, and that it is “not an AI-related breach” (ABC News). No demands or threats had been received, but someone claiming responsibility posted online and police are monitoring several platforms (ABC News). NSW Transport Minister John Graham called the incident a “big reminder about the importance of cyber security” (Insurance Business). Based on the facts disclosed so far, no notification trigger under NSW’s Mandatory Notification of Data Breach scheme had been identified (Insurance Business).

Am I affected?

  • Dentists and third-party dental providers who dealt with NSW Health through the Oral Health Fee For Service Scheme may have had identification details taken; police describe a “significant amount of personal identification information” about dentists (ABC News).
  • Patients: NSW says no patient information was compromised and no clinical services are at risk (ABC News), and a Cyber Security NSW spokesperson said no patient data was impacted “at this time” (SBS News).
  • Other NSW government agencies: none were affected, according to Marie Patane (ABC News).

What to do now

  1. If you are a dental or other third-party provider under OHFFSS, treat your professional identification details as potentially exposed, since police describe significant personal identification information about dentists among the stolen data (ABC News).
  2. Be wary of phishing and impersonation that references your provider or dentist details, as a party has claimed responsibility online (ABC News).
  3. Patients need take no action for patient data, which NSW says was not compromised (ABC News); still ignore any scam that claims to relate to this breach.
  4. Watch for official updates from NSW Health and Cyber Security NSW, which is leading the state’s response to the major incident (SBS News).
  5. Report suspected identity crime to police, since investigators say they will look into any identity crimes arising from the breach (ABC News).

Sources