Ampath Cautions About Overstated Numbers As Cybersecurity Incident Probe Continues

Ampath can confirm that it recently detected and contained a cybersecurity incident that affected part of its IT environment. An investigation, supported by independent cyber forensic specialists and legal advisers, is currently ongoing to determine the full scope and impact of the incident.

Ampath can emphatically confirm that, to date, there is no evidence that patient medical records, health diagnoses, pathology test results or banking information have been compromised.

At this stage, the information potentially affected appears to be limited to certain personal demographic and related administrative information. The investigation remains ongoing, and we continue to validate all findings through an independent forensic process.

Ampath further notes that the alleged claims of "80 million patient records" should not be interpreted as 80 million individual patients. The publicly cited number appears to refer to database records or entries (data rows) rather than unique individuals.

In healthcare environments, a single patient may generate multiple records over many years of interactions with a healthcare provider. These may include administrative records, registrations, account updates, requests, transactions, laboratory-related entries, and other data points associated with that individual. Consequently, multiple database records may relate to a single person.

Ampath believes the figure currently being circulated materially overstates the number of individuals potentially affected, and we urge caution against accepting unverified claims made by threat actors as a reflection of the actual impact of the incident.

Immediate action taken

Upon detecting the incident, on 2 October 2026, Ampath immediately activated its incident response protocols and implemented extensive containment and remediation measures.

These included blocking malicious IP addresses, restricting access to affected systems, implementing additional endpoint security controls, removing unauthorised files, disabling exposed accounts and credentials, restoring affected systems from clean backups, addressing identified vulnerabilities, strengthening application and access controls, and conducting extensive security testing and vulnerability scanning.

Ampath has also notified the Information Regulator and continues to cooperate fully with the relevant authorities.

There is no evidence of ongoing unauthorised access, and our cybersecurity specialists continue to review forensic evidence and monitor the environment.

We recognise reports of this nature can cause concern among patients, healthcare professionals, partners and the broader public. While we remain committed to transparency, it is important that information shared with the public is based on verified forensic evidence rather than claims made by threat actors, whose statements often cannot be independently verified.

Ampath's laboratories, pathology services and patient care operations remain fully functional, and there has been no disruption to service delivery.

As the investigation progresses, Ampath will continue to engage transparently with regulators, stakeholders and affected parties and will provide further updates as verified information becomes available.