NSW Police have launched a criminal investigation into an alleged cyber security breach affecting NSW Health, with specialist detectives from the State Crime Command’s Cybercrime Squad investigating the incident under Strike Force Civic.
Police confirmed they were notified of the suspected breach at approximately 1pm on Friday, 30 October 2026.
In an official statement, a NSW Police spokesperson said:
“About 1pm on Friday, 30 October 2026, State Crime Command’s Cybercrime Squad were alerted to an alleged data breach at NSW Health.”
“Detectives have commenced an investigation under Strike Force Civic and are working closely with NSW Health and Cyber Security NSW.”
The investigation follows the identification of a cyber security incident involving an isolated server within NSW Health’s infrastructure.
Cyber Security NSW, the state government agency responsible for coordinating responses to significant cyber security incidents, has confirmed that the breach has been classified as a major incident.
In an official statement, Cyber Security NSW said:
“Cyber Security NSW is responding to a cyber breach impacting an isolated server within NSW Health.”
“The breach has been declared a major incident and is being investigated by the NSW Police Cyber Crime Squad.”
The agency also confirmed that its current assessment had not identified any compromise of patient information.
“No patient data has been impacted at this time nor is any patient data currently at risk from this limited cyber breach.”
The investigation is being coordinated between NSW Police, NSW Health and Cyber Security NSW, with detectives examining the circumstances surrounding the alleged unauthorised access.
NSW Police have not publicly confirmed the identity of any suspected offender, the method used to access the server, or the nature and volume of information potentially obtained.
The official police statements reviewed also do not establish whether information was successfully exfiltrated or whether the incident involved ransomware or other malicious software.
Cyber Security NSW has declined to provide further operational details while the criminal investigation remains active.
“As this is a criminal investigation, no further comment is available,” the agency stated.
Strike Force Civic remains responsible for investigating the alleged breach, with NSW Police working alongside the state’s health and cyber security authorities.
The investigation is ongoing.
