---
title: "NSW Health oral-health provider-document incident"
description: "NSW Health confirmed theft of practitioner documents from an oral-health administration website, with no patient-data compromise identified."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-07"
canonical_url: "https://www.ally.security/incidents/nsw-health-oral-health-provider-document-incident-2026"
markdown_url: "https://www.ally.security/incidents/nsw-health-oral-health-provider-document-incident-2026.md"
stix_url: "https://www.ally.security/incidents/nsw-health-oral-health-provider-document-incident-2026/stix.json"
---

# NSW Health oral-health provider-document incident

NSW Health confirmed theft of practitioner documents from an oral-health administration website, with no patient-data compromise identified.

Last modified Nov 7, 2026 · 1 source

## Summary

- **Environment:** Oral Health Fee For Service Scheme administration website
- **Operational impact:** Provider documents obtained; dental care continued
- **Financial impact:** No quantified cost disclosed

## What happened

A third party unlawfully obtained uploaded records from [NSW Health](https://www.health.nsw.gov.au/)’s Oral Health Fee For Service Scheme administration website on October 29, 2026. NSW Health detected the activity within hours. [1](#source-1)

## Impact

Records generally concerned dental practitioners’ radiation licences and vaccination documents, particularly COVID-19 vaccination statements. Individual scope remained under review; no patient data had been identified as compromised. [1](#source-1)

## Timeline

### October 29, 2026 — Provider documents obtained; incident detected

Uploaded practitioner records were obtained unlawfully, and NSW Health detected the incident within hours. [Source account](https://www.health.nsw.gov.au/oralhealth/Pages/cyber-security-incident-faqs.aspx). [1](#source-1)

### November 6, 2026 — FAQ sets out affected document types and response

The revised FAQ identified the document types under review and confirmed continuing dental care. [Source account](https://www.health.nsw.gov.au/oralhealth/Pages/cyber-security-incident-faqs.aspx). [1](#source-1)

### November 7, 2026 — Briefing updated

This briefing was last reviewed and updated on November 7, 2026.

## Threat Group & Attack Vector

The incident affected an isolated server. NSW Health had not publicly established the initial access method or attacker identity. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

NSW Health secured the isolated affected server and said it considered there was no ongoing threat. Dental care, voucher issuance and payments continued; affected-practitioner notifications were being prepared while police and cyber authorities investigated. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/nsw-health-oral-health-provider-document-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Frequently asked questions – Oral Health Fee For Service Scheme cyber incident

official · NSW Health · Nov 6, 2026

<https://www.health.nsw.gov.au/oralhealth/Pages/cyber-security-incident-faqs.aspx>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   NSW Health oral-health provider-document incident: Records generally concerned dental practitioners’ radiation licences and vaccination documents, particularly COVID-19 vaccination statements. Individual scope remained under review; no patient data had been identified as compromised.
2. **Resulted In · 100% confidence · current**  
   NSW Health oral-health provider-document incident: A third party unlawfully obtained uploaded records from NSW Health’s Oral Health Fee For Service Scheme administration website on October 29, 2026. NSW Health detected the activity within hours.
3. **Affected Organization · 100% confidence · current**  
   NSW Health oral-health provider-document incident: NSW Health
4. **Occurred At · 100% confidence · current**  
   Provider documents obtained; incident detected: 2026-10-29
5. **Discovered At · 100% confidence · current**  
   NSW Health oral-health provider-document incident: 2026-10-29
6. **Resulted In · 100% confidence · current**  
   NSW Health oral-health provider-document incident: NSW Health secured the isolated affected server and said it considered there was no ongoing threat. Dental care, voucher issuance and payments continued; affected-practitioner notifications were being prepared while police and cyber authorities investigated.
7. **Began At · 100% confidence · current**  
   NSW Health oral-health provider-document incident: 2026-10-29
8. **Resulted In · 100% confidence · current**  
   NSW Health oral-health provider-document incident: FAQ sets out affected document types and response
9. **Occurred At · 100% confidence · current**  
   FAQ sets out affected document types and response: 2026-11-06
10. **Resulted In · 100% confidence · current**  
   NSW Health oral-health provider-document incident: Provider documents obtained; incident detected

</details>