The New South Wales (NSW) Health inadvertently exposed confidential documents of nearly 600 medical staff, including 67 senior doctors, via a misconfigured website platform. The leaked data—part of the 'credentialing process' for current, former, and prospective senior medical officers (2020–2025)—included highly sensitive personal and professional records: passports, driver’s licences, Medicare cards, medical qualifications, work histories, logbooks, reference letters, and registrations with regulatory bodies (Ahpra, medical colleges). While no malicious use was confirmed, the breach posed severe risks of identity theft, fraud, and impersonation (e.g., applying for medical roles, purchasing drugs like fentanyl, or generating fake expert opinions). NSW Health acknowledged the 'unauthorised disclosure' stemmed from a website configuration error, not a cyberattack, and offered affected staff reimbursement for ID renewals and support via IDCare. The incident sparked outrage among doctors, with unions criticizing NSW Health’s 'reckless' data handling and 'double standards' in safeguarding staff privacy while enforcing strict social media policies on them.

More than 1,000 medical records of over 400 patients were found on the floor of the derelict and former site of the Garrawarra Centre ,an aged care facility operated by the NSW Government. A selection of documents obtained by the ABC and safely returned to NSW Health had been cleared of asbestos contamination. People shouldn't be able to see those records, they're personal, and that home is supposed to have a duty of care.