A state health department is scrambling to trace the full extent of a major server breach, with specialist cyber cops brought in to investigate.
Authorities confirmed on Wednesday detectives are investigating an alleged breach of NSW Health data after a hacker claimed to have compromised 100,000 - or 70gb - in sensitive documents.
Cyber security police made Health Minister Ryan Park aware of the breach at the weekend, but waited to inform the public.
Mr Park said no patient details or information were compromised - "at this stage".
"There's no clinical risk or clinical service that has been compromised," he said.
"But I also hasten to say that we are in a live investigation."
Investigators traced the breach to a remote health server, he said.
Mr Park said he did not have advice suggesting a rogue AI agent was involved, but did not know who could be responsible.
Asked if "sensitive" documents were accessed, Mr Park said he would let police talk to specifics, including hackers' online claims.
"What I have been advised is no compromising in terms of patient data specifically," he said.
He said the department would consider necessary security improvements after the investigation.
"The reality is, for all government agencies and individuals, this is going to be a part of the challenges we face in terms of criminal activity going forward, and we will need to constantly look at what we're doing in this space, how to strengthen and harden up our systems and controls."
Police's Strike Force Civic are working with NSW Health and Cyber Security NSW to investigate the breach.
"Cyber Security NSW is responding to a cyber breach impacting an isolated server within NSW Health," a spokesman said.
"No patient data has been impacted at this time nor is any patient data currently at risk from this limited cyber breach."
An online cybersecurity hack-tracing service, Hackmanac, shared an image of a dark web forum where a hacker claimed to have been responsible for the breach.
An account claimed to have accessed the files before accidentally crashing a NSW Health server on the forum.
"No ransom is asked from anyone affiliated with the government of Australia, and I have already sent a quick notification to the CERT's team," a post read.
Hackmanac shared the details in a post to X, saying its verification status remained "pending".
State government servers were targeted in March 2025 when an account used automation to download more than 9000 files from NSW JusticeLink.
The platform allows lawyers, police and businesses to upload sworn statements, identity information and other files for the 400,000-plus court cases filed each year.
