What happened

NSW Health has declared a major cyber incident after unauthorised access to a single website, the Oral Health Fee For Service Scheme portal. NSW Police's Cybercrime Squad was alerted on 30 October and is investigating under Strike Force Civic, working with Cyber Security NSW.

Authorities say no patient data was compromised. Instead, around 4GB of personal identification details belonging to third-party providers, mainly dentists, was taken. Police believe the attackers are based outside Australia.

Why it matters

Even an isolated, low-profile website can hold enough third-party data to trigger a major incident. Partner and supplier records are often stored with weaker controls than patient or customer data, yet they carry the same regulatory and reputational weight.

How to protect your AWS environment

• Inventory every public-facing site and portal, including small legacy ones.
• Classify partner and supplier data with the same care as customer data, and encrypt it at rest.
• Monitor for large or unusual data transfers from web-tier resources.

Source: Click to Read the original report (ABC News)