What happened
NSW Health confirmed in June 2021 that identity information — and in some cases health-related personal information — was contained in files accessed during the global Accellion file-transfer breach, though its medical-records systems were not affected [nswh-co], [nswh-mr], [nswh-itnews]. NSW Health said the attack on the Accellion file-transfer system ran from mid-December 2020 through January 2021 [nswh-co].
Timeline
- 2020-12 to 2021-01 — Attacks on the Accellion file-transfer system [nswh-co].
- 2021-06-04 — NSW Health issued a media release confirming personal information was accessed; it said the matter was being investigated by Strike Force Martine (NSW Police with Cyber Security NSW) [nswh-mr].
Current status
Disclosed. The number affected was not disclosed. This was a separate agency caught in the same Accellion event as Transport for NSW. A police investigation (Strike Force Martine) was reported by NSW Health [nswh-mr]; no regulator action has been sourced.
Why it matters
Even without clinical-system access, exposure of identity and some health data from a health department is sensitive.