NSW Health leaks medical staff credentials in website misconfiguration
Learn More
New South Wales Health is reporting a data breach that accidentally exposed confidential documents belonging to nearly 600 medical staff members across two major health districts.
The breach was discovered on August 21, 2025, when the South Eastern Sydney Local Health District identified that information supposed to be password-protected was "found to be publicly accessible via the district's website."
The cause of the breach was a technical misconfiguration. The confidential documents were mistakenly made accessible on the South Eastern Sydney and Illawarra Shoalhaven local health districts' websites, which use a shared system, "via search."
The compromised information includes:
- Personal identity documents (passports, driver's licenses, Medicare cards)
- Professional certificates with proof of credentials
- Complete work history documentation
- Medical logbooks and training records
- Letters of reference from colleagues and supervisors
- Registrations to the medical regulator Ahpra
- Registrations to various medical colleges
- Tax documents and financial information
Using the documentation, someone could apply for a role in the health system, or they could also use a doctor's identity to buy drugs, including opioids like fentanyl.
All documents are removed from public access and a full investigation is underway, including forensic analysis. The districts have also engaged IDCare, Australia's identity and cyber support service, to provide free advice and support to staff.
The South Eastern Sydney local health district will reimburse the cost of renewing identification documents including passport, drivers licence, and birth certificate.
