International actors responsible for ‘major’ NSW Health data breach

A US-based hacker has claimed responsibility for breaching a NSW Health database and successfully stealing sensitive files related to a yet-unclear number of private dentist clinics across the state.

According to Hackmanac, a verified X thread which tracks illegal data breaches, a hacker who works under the tag ‘bytetobreach’ has claimed to have pillaged around 100,000 sensitive documents from NSW Health.

On Friday, internal NSW Health systems detected unusual activity, and within three hours NSW Police had begun investigating the activity as a major data breach at the hands of international actors.

The hacker has claimed to have stolen around 70 gigabytes of data, but NSW Police have rejected the claim, giving a significantly smaller ballpark figure of around 4 gigabytes.

On Wednesday afternoon eHealth NSW Chief Executive Richard Taggart said the incident had targeted the ‘oral health fee-for-service’ website, which allows people to apply for vouchers from NSW Health so they can pay for dental work.

“There’s no patient data involved at all in this circumstance. It’s only a small number of third party provider data that we look at,” he said.

NSW Police Cyber Crime Squad Commander Matt Craft didn’t confirm whether police were focusing specifically on Bytetobreach, but he did say the US-based hacker was well-known to the Cyber Crime Squad, describing them as “a nuisance” who had previously made false claims.

“We’re aware of certain posts that have been made and that will form part of our criminal investigation as we move forward,” Superintendent Craft said.

“Just because somebody is posting something online using a handle, doesn’t make it true. We need to assess that.”

Superintendent Craft said there was an “international flavour” to the investigation, and NSW Police have engaged with US Homeland Security and the Federal Bureau of Investigation.

“With cybercrime, there is no borders. It doesn’t stop at NSW and it can extend overseas and internationally.”

“We have seen that in this particular occasion,” he said.

Superintendent Craft said hackers, or ‘threat actors’, often access random sets of data without specifically being interested in what they contain as an exercise to see how far they can get into any given system.

He described this as “knocking on the firewall looking for an opportunity”.

“We need to be very clear, this is a criminal act. NSW Health is a victim in this case. They’ve been subjected to the criminal act as you would be if somebody broke into your home and stole your TV. It’s a similar type of criminal behaviour and it shouldn’t be tolerated,” he said.

Earlier on Wednesday, Health Minister Ryan Park said no patient details or info had been compromised.

“There’s no clinical risk or clinical service that has been compromised in terms of any future risks,” Mr Park said.

“We will make sure that we keep the community and individuals updated as best we can, but we have to do that knowing that we are going through a police investigation.”

Mr Park said NSW Health had “very robust cybersecurity systems in place” but said criminal activity and hacks were challenges all governments must face.

“The reality is for all government agencies and individuals – this is going to be a part of the challenges we face in terms of criminal activity going forward, and we will need to constantly look at what we’re doing in this space,” he said.

“How to strengthen and harden up our systems and controls. That’s what we’re doing all of the time given the nature of sensitive information that we have.

“But criminals are criminals. They evolve in relation to the work that they do. We need to make sure that we’re moving as well.’