NSW Health cyber breach shows hospitals must treat cyber resilience like a clinical priority

When the police declare a 'major incident' to investigate a cyber security breach at NSW Health, it is not merely an IT problem: it is a potential threat to the functioning of care systems that millions rely on. Authorities have reassured the public that patient data has not been compromised in this case. That is welcome — and it must be the starting point for a frank appraisal of how Australian health services guard against digital harm. Hospitals and health agencies increasingly depend on connected systems for everything from scheduling to diagnostics and life-support monitoring. That connectivity delivers efficiency and better care — but it also creates more points of vulnerability. A breach that disrupts operations can delay surgeries, impede access to records, and force clinicians to revert to paper processes; worse, it can corrode public trust at a time when confidence in institutions matters. The fact NSW Health immediately involved police and declared the incident a major investigation is appropriate and necessary. Rapid criminal inquiry helps to determine whether actors behind the breach are profit-motivated criminals, state-supported hackers, or opportunists exploiting weak defences. The swift official reassurance that patient data appears safe is also important: if personal details had been exposed, there would be long-term privacy and safety implications. But reassurance cannot substitute for transparency about what happened, how services were affected, and how recovery will be assured. This episode should prompt three pragmatic responses. First, health agencies must make cybersecurity a clinical safety priority. Investment decisions in hospitals often pit physical infrastructure against IT upgrades; the scale and nature of digital threats mean that cybersecurity cannot be relegated to an afterthought. Routine audits, up-to-date patching, staff training and incident response plans are essential and should be treated like fire safety checks. Second, governments must ensure clear lines of accountability and resourcing for cyber defence across the health sector. Fragmented responsibility between state and hospital administrations can leave gaps. If systems are centrally managed, collective protections and pooled expertise can be more effective; if responsibility is devolved, there must be minimum national standards and rapid escalation mechanisms. Third, the community has a stake in clear communication. Patients deserve to know whether their care might be delayed, whether appointments are affected, and whether any personal information is at risk. Authorities should provide timely, specific updates rather than reassurances that leave people guessing. We rely on health systems at our most vulnerable moments. The digital transformation of healthcare brings enormous benefits, but also new fragilities. A major cyber incident at a health agency is a public safety event as much as a technological breach. The NSW episode — investigated by police and, for now, not involving compromised patient data — should be a wake-up call: protecting hospitals from cyber harm must be resourced, governed and communicated with the same seriousness we apply to clinical emergencies.