Ampath Laboratories confirms cyberattack, disputes claim of 80 million stolen records

On 14 October 2026, Ampath Laboratories — one of South Africa's largest private pathology groups — confirmed it was responding to a cyber incident affecting part of its IT environment, after a threat actor began publicising claims that it had stolen large volumes of data from the company. Ampath said an investigation, supported by independent cyber forensic specialists and legal advisers, was ongoing to determine the full scope and impact of the breach, and that its laboratories, pathology services and patient care operations "remain fully functional," with no disruption to service delivery.

According to the company, the incident was first detected and contained on 2 October, with containment steps that included blocking malicious IP addresses, restricting access to affected systems, removing unauthorised files, disabling exposed accounts and credentials, and restoring affected systems from clean backups. Ampath said the affected information "appears to be limited to certain personal demographic and related administrative information," adding that it had found no evidence that patient medical records, health diagnoses, pathology test results or banking information had been compromised.

The attacker's claims

A threat actor tracked as ByteToBreach reportedly posted on a dark web forum on 13 October, claiming to have exfiltrated data from at least ten Ampath databases — including employee data, patient information and a lab admissions table said to contain 80 million records — and saying it was negotiating a ransom with no agreement reached. ByteToBreach, which security researchers describe as fronting as a penetration-testing firm while parading victims as "clients," has previously been linked to claimed breaches including Romania's cadastre agency.

Ampath's rebuttal

Ampath pushed back on the headline figure, saying the 80 million number "materially overstates the number of individuals potentially affected" and that it appears to refer to database records or entries — data rows — rather than unique people, since a single patient can generate many records over years of care. The company said it had engaged independent forensic specialists to validate its findings and that the investigation remained ongoing. As of the disclosure, the method of initial access had not been made public and the attacker's claims had not been independently verified.