Ampath Laboratories, one of South Africa’s largest pathology providers, has confirmed a cybersecurity incident that may have exposed personal information. A hacker group calling itself ByteToBreach claims it took more than 80 million patient records. Ampath has not confirmed that figure.
MyBroadband, the South African tech news site, reported the attack on 13 October 2026. “Ampath has experienced a cybersecurity incident which we have reasonable grounds to believe may have caused unauthorised access to, or acquisition of, personal Information,” the company told the site.
What Ampath says
Ampath said the information affected “may include name and surname, identity number, date of birth, age, sex, language, physical address, email address, and mobile numbers”. It said medical aid details and payment-related information may also have been taken.
“Importantly, there is currently no indication that health, diagnostic or clinical information was contained in the affected data,” Ampath said.
The company said it launched an investigation with outside forensic specialists and that the incident had been contained. It said it had notified South Africa’s Information Regulator under the Protection of Personal Information Act (POPIA).
MyBroadband reported that Ampath’s website was offline on Tuesday afternoon, 13 October, and partly restored by the evening with a statement about the incident.
What the attacker claims
According to MyBroadband, ByteToBreach announced the attack on a hacker forum on 13 October and posted screenshots. None of its claims have been independently verified.
ByteToBreach claimed: “10 out of 375 databases from Ampath were fully copied. It covers HR/employees, multiple patient databases, finances, and other databases containing LDAP and providers.”
It added: “The databases cover the whole period from the mid-2000s to the present day. The lab’s admission table alone contained well over 80 million records.” It also said “negotiations were short” over a ransom, without giving details.
The attacker posted links to what it said were samples of the data. MyBroadband reported that an online scan of one of these downloads on VirusTotal showed it was full of malware, including backdoors and trojans.
What this means
- The breach is confirmed, but its size is not. Ampath confirms an incident; the 80 million figure comes only from the attacker.
- Watch out for scams. Ampath warned that stolen data may be used for phishing and impersonation, especially requests for banking details.
- Don’t open the leaked files. The sample files were flagged as malware, according to MyBroadband.
Sources
- MyBroadband (Luis Monzon), “Attackers claim to have stolen 80 million South African patient records in massive Ampath Laboratories data breach”, 13 October 2026. https://mybroadband.co.za/news/security/672153-attackers-claim-to-have-stolen-80-million-south-african-patient-records-in-massive-ampath-laboratories-data-breach.html
