Pathology Lab Confirms Hack, But Disputes Data Theft Claims

A major South African pathology laboratory confirmed on Wednesday that it's responding to a recent cyber incident, but the company disputes claims by cybercriminals of a data theft that affects 80 million patients. The attack on Ampath Laboratories is the latest involving a medical testing laboratory.

See Also: Webinar | Verifying AI Agent Activity Against Your Data Policies

Ampath Laboratories in a statement said that on Oct. 2 it detected and quickly contained a cybersecurity incident that affected part of its IT environment.

"An investigation, supported by independent cyber forensic specialists and legal advisers, is currently ongoing to determine the full scope and impact of the incident," the company said in the statement issued through a news service.

Ampath said its laboratories, pathology services and patient care operations "remain fully functional, and there has been no disruption to service delivery."

But on Wednesday, it appeared that Ampath's own corporate website was offline.

Threat actor ByteToBreach reportedly posted on a darkweb hacker forum Tuesday that the gang had exfiltrated data from at least 10 Ampath databases, including employee data, patient information and a lab admissions table containing 80 million records.

BytetoBreach on Tuesday also reportedly claimed on the hacker forum that was negotiating a ransom payment with Ampath but that an agreement had not yet been reached.

Ampath on Wednesday disputed BytetoBreach's various claims.

"Ampath believes the figure currently being circulated materially overstates the number of individuals potentially affected, and we urge caution against accepting unverified claims made by threat actors as a reflection of the actual impact of the incident," the company said.

"Ampath can emphatically confirm that, to date, there is no evidence that patient medical records, health diagnoses, pathology test results or banking information have been compromised," the company said in its statement.

Ampath also contended that the threat actor's claims of 80 million patient records being stolen shouldn't be interpreted as 80 million individual patients. "The publicly cited number appears to refer to database records or entries - data rows - rather than unique individuals," the lab said.

"In healthcare environments, a single patient may generate multiple records over many years of interactions with a healthcare provider," Ampath said. These may include administrative records, registrations, account updates, requests, transactions, laboratory-related entries and other data points associated with that patient, the lab said. "Consequently, multiple database records may relate to a single person," the company said.

"At this stage, the information potentially affected appears to be limited to certain personal demographic and related administrative information. The investigation remains ongoing, and we continue to validate all findings through an independent forensic process," the company said.

Ampath said its "extensive" containment and remediation measures in the incident included "blocking malicious IP addresses, restricting access to affected systems, implementing additional endpoint security controls, removing unauthorized files, disabling exposed accounts and credentials, restoring affected systems from clean backups, addressing identified vulnerabilities, strengthening application and access controls, and conducting extensive security testing and vulnerability scanning."

Other Medical Lab Attacks

The attack on Ampath is among several high-profile hacks on other pathology laboratories worldwide in recent years. That includes a ransomware attack and data theft by Russian-speaking cybercrime gang Qilin on British pathology lab Synnovis, which also disrupted blood supply activities in the U.K. for several months in 2024 (see: Synnovis Notifying UK Providers of Data Theft in 2024 Attack ).

That same year, the Medusa ransomware gang claimed to attack U.S-based Summit Pathology Labs, which also resulted in 1.8 million people having their information compromised (see: Medusa Ransomware Hack on Pathology Lab Affects 1.8 Million ).)

"Cybercriminals have studied breach laws globally and know where they have leverage," said Mike Hamilton, CISO emeritus at IT firm Datec Inc. "The money is no longer concentrated in the sale of records. It is through the threat of making them public and causing regulatory fines, civil litigation and brand damage," he said.

"Pathology labs, medical imaging companies and other small healthcare service providers are being compromised more frequently and extorted over stolen records," Hamilton said.

Pathology data may also be used in medical research, and nation-state hackers have been known to accelerate their own research programs with stolen data, he said.

Meanwhile, BytetoBreach - the threat actor allegedly behind the Ampath hack - appears to target a variety of industries in several geographic regions, including other African nations. Other such attacks include a hack in July 2025 on Seychelles Commercial Bank, which provides personal and corporate services on Seychelles, one of the world's smallest countries (see: Seychelles Commercial Bank Confirms Customer Data Breach ).

Also this past July, researchers at security firm Kela tracked a breach claimed by ByteToBreach that targeted Romania's National Agency for Cadastre and Real Estate Publicity.