An alleged cyberattack against NSW Health has reportedly resulted in the theft of approximately 100,000 sensitive documents from a website used to administer dental vouchers.
The threat actor, ByteToBreach, claims to have compromised an NSW Health system by exploiting a misconfigured subdomain, allegedly exfiltrating approximately 70 GB of data before disrupting the server and causing it to crash.
The attacker reportedly published evidence of the alleged compromise, including screenshots and file-sharing links containing purportedly stolen material. The incident was first observed on 3 November 2026.
The affected website supports the Oral Health Fee for Service Scheme (OHFFSS), which allows eligible patients to access subsidised dental treatment through participating private dental practitioners.
According to media reporting, the compromised server was isolated from other NSW Health systems. NSW Police are investigating the incident alongside NSW Health and Cyber Security NSW.
There are discrepancies between the attacker’s claims and the information released by authorities. While ByteToBreach claims to have stolen approximately 70 GB of data across 100,000 documents, police have reportedly estimated the volume of potentially stolen information at approximately 4 GB.
Authorities have indicated that the potentially exposed information includes personal identification information relating to third-party healthcare providers, particularly dentists. NSW Health has stated that patient information has not been compromised and clinical services are not at risk.
The incident has been declared a major cyber security incident, with NSW Police investigating under Strike Force Civic.
About ByteToBreach
ByteToBreach is an active threat actor associated with data theft, extortion and ransomware operations.
In October 2026, ByteToBreach claimed attacks against South Africa’s Ampath Laboratories and systems supporting Sweden’s BankID. Reporting has also linked the actor to alleged compromises involving Pubali Bank Securities and Eurofiber France.
The actor has reportedly targeted telecommunications, government, healthcare, financial services and cloud-service organisations across Australia, Africa, Europe, Asia and Latin America.
Reported tradecraft includes exploiting public-facing applications, abusing valid accounts, accessing remote services, conducting internal discovery, staging data and collecting information from local systems, code repositories and cloud storage.
Technical analysis published in July 2026 also linked ByteToBreach to the Bytotocrypt ransomware strain and the Ligolo tunnelling tool, with reported activity affecting Linux systems.
The alleged NSW Health compromise adds another healthcare-related incident to the group’s reported activity. However, the specific intrusion techniques and full extent of the compromise remain subject to investigation.
Incident details
| Attribute | Details |
|---|---|
| Threat actor | ByteToBreach |
| Target | NSW Health, Australia |
| Affected service | Oral Health Fee for Service Scheme |
| Alleged access method | Misconfigured subdomain |
| Claimed data volume | Approximately 70 GB |
| Claimed document count | Approximately 100,000 |
| Data type | Sensitive documents and personal identification information |
| Date observed | 3 November 2026 |
| ESIX© | 5.58 |
| Status | Pending verification |
While the attacker’s claims remain unverified, the reported compromise highlights the security risks associated with internet-facing applications and supporting infrastructure, particularly where systems process sensitive healthcare-related information.
Sources:
