Cyber threat intelligence platform Hackmanac shared a screenshot of a dark web forum post where the user “bytetobreach” said they had accessed the documents. Hackmanac said on social media: “Threat actor bytetobreach claims to have compromised NSW Health systems by exploiting a misconfigured subdomain, allegedly exfiltrating approximately 70GB of data comprising 100,000 sensitive documents dating from 2020 onwards.”
Cyber Crime Squad detectives were notified about the alleged breach about 1pm on Friday. Health Minister Ryan Park said he had been made aware of the issue in "the last couple of days", but that it was not made public at the request of police, who wanted to determine when to go public.
The minister said he had been advised no patient data or information had been compromised and no risk to clinical services had been identified, but noted the investigation was live. “Things can and may, and often do in this type of incident, change,” Park said.
A Cyber Security NSW spokesperson said there had been a “limited” breach of an isolated NSW Health server and that no patient data had been impacted at this time. “No patient data has been impacted at this time nor is any patient data currently at risk,” they said.
The hacker’s forum post claimed that no ransom was being sought from anyone affiliated with the Australian government and that a notification had been sent to the Computer Emergency Response Team. “A full intrusion into the rest of the network was prevented when I accidentally crashed the server,” bytetobreach wrote.
Hackmanac said the claim was pending verification.
Park said the state has robust cybersecurity systems in place but that they would continue to be challenged by hackers. He called it an evolving criminal activity and said the government would need to keep looking at how to strengthen its systems and controls.