A hacker using the alias ByteToBreach posted claims on an underground forum on November 3 that they had stolen roughly 70 gigabytes of data, around 100,000 documents, from NSW Health. The hacker says the data spans the covid era through to 2026 and claims they breached a misconfigured subdomain. They say a fuller intrusion into the rest of the network was cut short when they accidentally crashed the server, and that they are not seeking a ransom from anyone linked to the Australian government.
Cyber Security NSW confirmed it is responding to a breach affecting what it called an isolated server within NSW Health. The department notified NSW Police, and the NSW Police Cyber Crime Squad is now investigating it as a major incident. NSW Health says no patient data has been affected at this time and that none is currently at risk from what it describes as a limited breach. Because the matter is now a criminal investigation, the department says it has no further comment.
Kash Sharma, Asia-Pacific managing director at security firm BlueVoyant, questioned the word isolated. Large health systems are rarely truly standalone. They connect to vendors, contractors, and third-party platforms that move data in and out constantly, and each of those connections is a path the word isolated does not account for. Sharma's point was direct. An early reassurance that a server is cut off from the rest of the network is only as reliable as the organisation's visibility into everything that server actually talks to.
None of ByteToBreach's claims have been independently verified. The 70 gigabyte figure, the misconfigured subdomain, and the story about crashing the server all come from the hacker's own forum post. NSW Health has not confirmed the volume of data taken or the method of entry. What NSW Health has done is deny patient data is at risk while a criminal investigation that started two days ago is still running, which is the fastest and least informed moment to make that call.
A subdomain is exactly the kind of asset large institutions lose track of. It gets spun up for a vendor integration, a conference registration page, or a one-off contractor project, then sits forgotten while still pointing at production infrastructure. Nobody audits it because nobody remembers it exists. ByteToBreach's claim, if true, describes an unpatched, unmonitored entry point that a state health department didn't know it still had exposed.
Health data covering a multi-year span including a pandemic carries exactly the kind of information people cannot opt out of generating. You do not get to decide whether your test results, your vaccination record, or your treatment history exists somewhere in a government system. You can decide how much else you hand to systems that have already shown they lose track of their own exposure, and you can treat every institutional claim of isolation or limited scope as a statement made before anyone has finished looking, not after.
Blackout VPN exists because privacy is a right. Your first name is too much information for us.
Keep learning
FAQ
What data does the NSW Health breach reportedly include
The hacker claims to have taken 70 gigabytes of data, around 100,000 documents, spanning the covid era through to 2026. None of this has been independently verified.
Has NSW Health confirmed patient data was exposed
No. NSW Health says no patient data has been affected at this time and that none is currently at risk, but the investigation is still active.
How did the hacker reportedly access NSW Health's systems
The hacker, using the alias ByteToBreach, claims they breached a misconfigured subdomain. NSW Health has not confirmed this method.
Why did an expert question NSW Health calling the server isolated
Kash Sharma of BlueVoyant said large health systems rarely have truly standalone servers because of ongoing connections to vendors, contractors, and third-party platforms.
Is this breach being investigated as a crime
Yes. The NSW Police Cyber Crime Squad is investigating it as a major incident, which is why NSW Health says it has no further comment.