NSW Health Provider Data Breach: What Dental and Health Practices Should Do Now
NSW Health has confirmed a cyber attack on the website behind its Oral Health Fee For Service Scheme, and police say the stolen data is personal information about the dentists and other providers who use it.
Cyber Security NSW found unauthorised access on 29 October and has declared a major incident. Police estimate about 4GB was taken and are investigating under Strike Force Civic. Officials say no patient data was affected, according to ABC News. A hacker has separately claimed a far bigger theft from NSW Health, but Information Age reports that claim is still unverified.
Why this matters for your practice
Patient records are not the prize here. A list of real practice owners, with contact details and a proven link to a government scheme, is exactly what scammers need for a believable "payment update" or "scheme audit" email. Our view: the biggest risk to NSW practices, from the Northern Beaches to the Central West, is a fake invoice or bank detail change that arrives looking like normal admin. NSW Health has not said which fields were taken, so assume your name, address and contact details are out there.
What to do this week
- Distrust unexpected contact. Treat emails, texts and calls claiming to be NSW Health or the scheme with suspicion, and call back on a number you already hold.
- Verify payment changes. Confirm any change to bank details or payment instructions by phone before acting on it.
- Lock down logins. Change passwords on any scheme or government portal account and turn on MFA wherever it is offered.
- Brief your front desk. A five-minute huddle with reception and admin staff today beats a policy document next month.
- Check your mailboxes. Look for unfamiliar sign-ins and hidden forwarding rules in Microsoft 365.
Hacker claims 100,000 documents stolen from NSW Health, Information Age
Frequently Asked Questions
Was patient data stolen in the NSW Health breach?
NSW Government officials say no patient data was compromised. Police say the stolen data is personal identification information about providers in the scheme. NSW Health has not published the full list of fields, so assume names and contact details are exposed.
What scams should dental and health practices expect?
Expect emails, texts or calls pretending to be NSW Health or the scheme, asking you to update payment details, fix a voucher problem or respond to an audit. Many will link to fake login pages. Always verify by calling a number you already hold.
Do I need to report this to the OAIC?
Not because of this incident alone, as it involved a government website and not your own systems. If you see signs that your own accounts were accessed, get advice quickly on your Notifiable Data Breaches obligations under the Privacy Act.
How can All IT Services help my practice?
We can review your Microsoft 365 sign-in logs, MFA coverage and mailbox rules, and run a short phishing awareness session for your team. Contact us and we will start with a quick check of your biggest gaps.
Not sure how exposed your practice is?
We will check your sign-ins, MFA and email rules and tell you plainly what to fix first.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →