South African lab Ampath confirms cyberattack, disputes hacker's claim of 80 million patients

Ampath Laboratories, one of South Africa’s largest pathology service providers, confirmed that it was the target of a cyberattack that may have resulted in unauthorized access to patient data, while disputing a hacker’s claim that more than 80 million patient records were stolen.

The threat actor ByteToBreach announced on a hacker forum on Oct. 13, 2026, that it had compromised Ampath, and posted screenshots of the attack. The group reportedly said it had exfiltrated data from at least 10 Ampath databases, including employee data, patient information and a laboratory admissions table with 80 million records. ByteToBreach also reportedly claimed it was negotiating a ransom payment with Ampath but had not reached an agreement.

Ampath said it detected and quickly contained a cybersecurity incident that affected part of its IT environment on Oct. 2. It said an investigation supported by independent forensic specialists and legal advisers is ongoing to determine the full scope and impact. The company said it has reasonable grounds to believe that records containing personal information may have been accessed or acquired without authorization, and it issued a notification to potentially affected people. It also notified South Africa’s Information Regulator under Section 22 of the Protection of Personal Information Act.

Ampath said the 80 million figure materially overstates the number of people potentially affected and urged caution unverified claims from threat actors. The company said the number appears to refer to database records or data rows rather than unique individuals, because one patient can generate many records over years, including registrations, account updates, requests, transactions and laboratory-related entries.

The company said the personal information that may have been affected includes names, identity numbers, dates of birth, ages, sex, language, physical addresses, email addresses and mobile numbers. Medical aid details, including the medical aid name, membership number and options, and payment-related information, including payer name, internal payment reference number, payment amount, and transaction date and time, may also be involved. Ampath said the affected information varies by individual and that not all records contain every field. It said there is no evidence that patient medical records, health diagnoses, pathology test results or banking information were compromised, and that the information potentially affected appears limited to demographic and administrative data.

Ampath said its laboratories, pathology services and patient care operations remain fully functional with no disruption to service delivery. Its corporate website was offline Tuesday afternoon, and by evening some functionality had been restored along with a statement the incident. The company said its containment and remediation work included blocking malicious IP addresses, restricting access to affected systems, disabling exposed accounts and credentials, removing unauthorized files, restoring systems from clean backups and addressing identified vulnerabilities.

The attack follows other high-profile incidents at pathology laboratories. In 2024, the Qilin ransomware gang attacked British lab Synnovis, disrupting blood supply activities in the UK for several months, and the Medusa ransomware gang claimed an attack on US-based Summit Pathology Labs that compromised the information of 1.8 million people.

Please take 30 seconds to register

Already have an account? Sign in

"If we think of usability and security as mutually exclusive - we have failed" - Jerrod Chong, Yubico

#teissLondon2018: On the internet, nobody knows you are a fridge

1 in 6 gamers disable all AV in the pursuit of the highest possible speeds

10 malicious Python Libraries discovered on PyPI Repository

126,000 affected by cyberattack on New Zealand patient portal Manage My Health

"If we think of usability and security as mutually exclusive - we have failed" - Jerrod Chong, Yubico

#teissLondon2018: On the internet, nobody knows you are a fridge

1 in 6 gamers disable all AV in the pursuit of the highest possible speeds

10 malicious Python Libraries discovered on PyPI Repository

126,000 affected by cyberattack on New Zealand patient portal Manage My Health

19-year-old claims he hacked into over 25 Tesla cars in 13 countries

2020 cybersecurity trends and resolutions

2025 in review: why cyber-security became a boardroom crisis

Closing the exposure window — unifying continuous threat exposure management

Trusting your AI agents

The blind spots in your stack - why fragmented data security fails

Winston House, 3rd Floor, Units 306-309, 2-4 Dollis park, London, N3 1HF