Ampath Laboratories, one of South Africa's largest pathology service providers, has confirmed a cybersecurity incident. The company says it has "reasonable grounds to believe" the incident "may have caused unauthorised access to, or acquisition of, personal information." A threat actor calling itself ByteToBreach has claimed responsibility. On a hacker forum on 13 October 2026, it said it had exfiltrated more than 80 million patient records, according to MyBroadband. Ampath has not published a figure for how many people are affected, so 80 million is currently only the attacker's claim. No independent source has verified it. The incident is significant because of how sensitive the data is: identity numbers, contact details, medical aid membership data, and possibly payment information.
What Happened
MyBroadband broke the story and is the only source that reports the breach directly. It says ByteToBreach announced the compromise on a hacker forum on 13 October 2026 and posted screenshots that it says were taken during the intrusion. MyBroadband describes ByteToBreach as a cyber extortionist that has previously targeted major organisations across Africa, including in Nigeria. Those earlier attacks are attributed to the outlet and have not been confirmed elsewhere.
When MyBroadband contacted Ampath, the company confirmed the incident. Its statement says:
- It "immediately launched an investigation" with help from external forensic specialists.
- The incident "has been successfully contained."
- It is notifying "potentially affected data subjects" because records containing personal information may have been accessed without authorisation.
The company also says it is acting in line with its data protection obligations. In South Africa that most likely means the Protection of Personal Information Act (POPIA), although Ampath did not name the law.
On the afternoon of 13 October, Ampath's public website was offline and showed a "coming soon" placeholder, according to MyBroadband. By that evening some functionality had returned and the site carried a statement about the incident. The outage could mean the company took systems offline on purpose for containment or that the attack disrupted services. The sources do not say which.
Scale of exposure: Ampath runs a large network of pathology laboratories and patient care centres across South Africa. Its public footprint shows how much patient data its branches handle. Current job listings for branch administrators in Mpumalanga and Mthatha describe staff "capturing request forms on our Ampath system," handling "sensitive information" and working with "clinical documentation and patient data." Its sites include hospital-based labs such as the one at Mediclinic Vergelegen in Somerset West. Data entered at hundreds of collection points feeds central systems, and those central systems are where attackers would expect to find records in bulk.
Note on naming: An unrelated Indian company, American Institute of Pathology and Laboratory Sciences Pvt Ltd, also trades as "Ampath." It announced a new laboratory in Meerut, Uttar Pradesh, on 12 October 2026. Nothing in the available reporting connects that company to this incident. Defenders and journalists should not mix up the two.
What Was Taken
Volume: The only figure available is ByteToBreach's claim of more than 80 million patient records (reported by MyBroadband). Ampath has neither confirmed nor disputed it. Two cautions apply:
- South Africa's population is roughly 63 million, so 80 million "records" almost certainly does not mean 80 million unique people. It more likely counts test requests, visits or duplicate entries that build up over years.
- Extortion groups often inflate their numbers to increase pressure.
Until Ampath or the Information Regulator publishes a count of affected data subjects, treat the 80 million figure as unverified.
Data types: According to Ampath's own notification, as quoted by MyBroadband, the affected personal information may include:
- Name and surname
- South African identity number
- Date of birth, age and sex
- Language preference
- Physical address, email address and mobile number
- Medical aid details: scheme name, membership number and plan option
- Payment-related information (the source text is cut off at this point, so the full scope is unclear)
Ampath's statement, as reported, does not mention test results, diagnoses or other clinical data. That does not mean clinical data was safe. It only means none of the available sources confirm or rule it out. For a pathology provider, laboratory results are the most sensitive asset and the obvious next question.
Why It Matters
Identity and medical fraud material: SA ID numbers combined with dates of birth, addresses, mobile numbers and medical aid membership numbers are enough for SIM-swap attacks, account takeover, fraudulent medical aid claims and convincing phishing. Medical aid numbers in particular make it possible to impersonate a scheme or provider ("your claim was declined, verify your details").
Pathology labs are concentration points: A single lab processes specimens referred by many doctors, hospitals and schemes, so one breach can expose patients from across the health system. The pattern is familiar. In 2019, a breach at the American Medical Collection Agency (AMCA), a billing vendor for laboratories, affected more than 27.5 million people, including over 10.2 million Labcorp patients. HIPAA Journal reports that AMCA went into bankruptcy and that Labcorp has now agreed a $2.29 million settlement with 44 US state attorneys general. More recently, HIPAA Journal reports that WPM Pathology Laboratory in Kansas settled class action litigation over a November 2024 cyberattack. That attack exposed names, Social Security numbers, diagnosis information and insurance claims data.
Regulatory and legal consequences: Those US cases show that the costs of a lab breach keep growing for years: regulators investigate, class actions follow, and companies are ordered to run security programmes, including appointing a qualified CISO. Ampath's notification suggests it is following its breach-notification duties under POPIA, and the Information Regulator will probably take an interest given the possible scale. How Ampath handles disclosure will matter as much as the technical response.
Regional threat activity: If MyBroadband's description of ByteToBreach as an actor targeting major African organisations is accurate, South African and Nigerian healthcare and enterprise defenders should treat this as an active regional campaign, not a one-off.
The Attack Technique
Not known. None of the sources describe the initial access vector, how long the attacker was inside, whether ransomware was deployed, or which systems were compromised. Ampath has said only that the incident is contained and that forensic specialists are investigating.
What the reporting does support:
- The attacker published screenshots on a hacker forum, which is typical of data-theft extortion.
- Ampath's public website was offline for part of 13 October.
- The company's wording, "unauthorised access to, or acquisition of," is consistent with data exfiltration.
Anything beyond that, including claims about specific vulnerabilities, phishing or ransomware families, would be speculation and is left out here.
What Organizations Should Do
- Hunt for bulk exfiltration from patient databases. Review database query logs, unusual exports and outbound transfer volumes from LIS (laboratory information system), billing and patient registration systems. Data-theft extortion often skips encryption, so a lack of ransomware does not mean a lack of compromise.
- Lock down access from distributed sites. Organisations with many branches, such as labs, clinics and pharmacies, give large numbers of front-line staff access to central patient systems. Enforce phishing-resistant MFA, least-privilege roles and per-branch access scoping so that one compromised branch account cannot query the entire patient base.
- Watch for impersonation of medical aid schemes. Medical aid schemes and providers should warn members about phishing, vishing and SMS lures that reference their membership numbers. They should also add verification steps for changes to banking or contact details.
- Harden against SIM-swap and account takeover. Banks and mobile operators serving South African customers should tighten SIM-swap and password-reset checks, given that ID numbers, dates of birth and mobile numbers may now be circulating together.
- Monitor forums and leak sites. Track ByteToBreach's postings for samples or full dumps that could expose your organisation's staff, patients or third-party data shared with Ampath.
- Prepare a POPIA breach notification playbook in advance. Make sure you can quickly work out which data subjects are affected and notify both them and the Information Regulator. Publish a clear statement early and do not leave customers looking at a "coming soon" page.
Sources: Attackers claim to have stolen 80 million South African patient rec... | WPM Pathology Laboratory; Salina Regional Health Center Settle Clas... | Labcorp Settles Multistate Data Breach Investigation for $2.3 Million | Ampath: Branch Admin Officer Vacancies in Mpumalanga - Jobza | Vacancy Details - Ampath Careers | Branch Administrator Mthatha Jobs in Mthatha - Ampath Laboratories | Ampath Vergelegen Laboratory | american institute of pathology laboratory sciences in collaborat