- South African pathology provider Ampath has confirmed a cybersecurity incident involving possible unauthorised access to personal information.
- Threat actor ByteToBreach claims it copied over 80 million records, but this is no verified patient count.
- Ampath says it has no evidence that medical records, test results, diagnoses or banking details were compromised.
South African pathology provider Ampath has confirmed a cybersecurity incident. A threat actor says it stole a huge amount of data from the company. A threat actor means a hacker or a group of hackers.
The claim has raised concerns about the personal information of patients. Other people who dealt with the laboratory over the years may also be affected. The company has since issued statements to clarify the situation.
Ampath Confirms Incident After Hacker Posts Claim on Forum
Ampath Laboratories is one of the largest pathology service providers in South Africa. The company confirmed the incident after a hacker called ByteToBreach made a bold claim. The hacker says it stole more than 80 million records from Ampath. Ampath accepts that an incident happened. However, it disputes the scale of the breach.
According to a report published on October 13, 2026, ByteToBreach announced the alleged breach on a hacker forum. The attacker said it copied data from several Ampath databases. It also claimed the records go back to the mid-2000s and run up to the present day. That covers about twenty years of activity.
However, nobody has verified the figure of 80 million records. Unverified means no independent check has confirmed it. Ampath has warned people not to read the number as 80 million affected individuals. The company explained that one person can create many database entries.
Registrations, administrative updates, transactions and other interactions each add a new entry. For example, a patient who registers, updates an address and pays a bill could create three entries. So a single patient may appear in the databases many times.
Another report published on October 14 shared Ampath’s view on the number. The company believes it greatly overstates the people who could be affected. The reports do not give a confirmed count of affected people. ByteToBreach made the claim, and Ampath has answered it with statements of its own.
Names, ID Numbers and Contact Details May Be Involved
Ampath said the incident may have allowed unauthorized access to some personal and administrative information. In simple terms, someone may have gotten in without permission. The company placed these details in the demographic group. Demographic details describe basic facts about a person. The company then listed what could be involved.
Some of them identify a person. These include names, identity numbers, dates of birth, ages and sex. Others show how to reach a person. These include physical addresses, email addresses and mobile numbers.
Medical aid details may also be involved. These include membership numbers and plan options. Some payment-related administrative information could be part of the group too.
Ampath drew a clear line between these details and patients’ health information. In its latest reported update, Ampath said it has seen no evidence of stolen patient medical records. It said the same about health diagnoses, pathology test results and banking information. Ampath stressed that investigators are still studying the incident. They want to learn its full scope and impact.
Another healthcare data incident involved a hacker claiming that a breach at Alaxione exposed information linked to 6.8 million patients.
Ampath said these details may be involved. It did not say that all of them were taken. These statements also do not confirm how many people may have been affected.
Investigation Continues as Ampath Warns of Scam Risks
Ampath detected the incident on October 2, 2026. The company then activated its incident response procedures. It has since put containment and remediation measures in place. Containment limits the damage. Remediation repairs it.
The company also hired independent cybersecurity specialists to investigate what happened. Ampath told South Africa’s Information Regulator about the incident under the Protection of Personal Information Act (POPIA). It keeps reviewing forensic evidence, which means digital clues left behind by the attack. It is also strengthening its security controls.
Reports say the possible exposure of identity and contact details could raise some risks. These include targeted phishing, impersonation and social engineering. Phishing means fake messages that trick people into sharing private details. Impersonation means pretending to be someone else. Social engineering means tricking people into trusting a false story.
Criminals may use real personal details to make fake emails, phone calls or messages look believable. Ampath has advised people to stay alert to suspicious communications. The company named requests for banking or financial information as a special concern.
For now, one key difference stands out. The cybersecurity incident is confirmed. The amount of stolen data is only the attacker’s claim. Investigators have not yet shared the full extent of the incident in public. So the alleged 80 million records should not count as 80 million confirmed victims.
More verified findings will be needed. They will show what information was actually accessed. They will also show how many people, if any, need extra protective measures. Until then, the true number of affected people stays unknown.
