Ampath, one of South Africa's largest pathology groups, has confirmed a cyberattack detected on 2 October 2026. It says identity numbers and medical aid details may have been accessed. It also says the circulating claim of 80 million patient records should not be read as 80 million people.
What happened
Threat actor ByteToBreach posted on a hacker forum on 13 October claiming it had taken more than 80 million patient records from Ampath and published screenshots. Ampath confirmed it had been attacked and that personal information was likely compromised.
In a statement reported on 14 and 15 October, Ampath said the investigation is still running with independent forensic specialists. It said there is, to date, no evidence that diagnoses, pathology test results, clinical records, or banking information were taken. It has notified the Information Regulator under section 22 of POPIA and says there is no evidence of ongoing unauthorised access. Laboratories and patient care remain operational.
Ampath's own reading of the 80 million figure is that it refers to database rows, not unique patients. One person can generate many administrative records over years of registrations, account updates, and transactions. That correction is the company's position. It is not an independent count of people affected, and Ampath says its findings are still subject to forensic verification.
Who is affected
This is a South African healthcare incident, not a software patch. Anyone who has used Ampath should assume contact and identity data may be in circulation until the company publishes a verified scope.
- Patients and account holders whose demographic and administrative records sat on the affected systems.
- Fields Ampath has named as possibly affected: name and surname, identity number, date of birth, age, sex, language, physical address, email, mobile number, medical aid name, membership number and option, and payment-related information.
- Medical schemes, employers, and brokers that receive Ampath results or bills and may now field phishing that uses real membership numbers.
- Not confirmed taken, per Ampath: diagnoses, pathology results, clinical records, and banking details.
What to do now
Treat unexpected calls and messages that cite a real Ampath visit, ID number, or medical aid membership as hostile until you verify them on a known number.
- Do not open links or attachments in emails or WhatsApp messages that claim to be an Ampath breach notice. Use the contact details already on an old invoice or the public Ampath site.
- Watch medical aid statements for membership changes, new dependents, or claims you did not make.
- If you process Ampath data for clients, confirm whether you received a section 22 notice and log what fields you actually hold.
- Reset any Ampath patient-portal or results-portal password that was reused elsewhere. Do not wait for a unique-patient count.
What this means for South African businesses
The useful fact for an MSP is not the headline number. Ampath has confirmed a compromise of identity and medical-aid data and has disputed the scale. Clients in healthcare, broking, and payroll will now see phishing that quotes a real ID number or membership number, which is enough to get past a busy receptionist.
A pathology group sitting on years of registrations can leak far more rows than people, so any client who repeats the 80 million figure in a staff mail is overstating a claim the victim has already walked back. The exposure that matters is narrower and more useful to a fraudster: ID numbers plus a medical aid membership.
Source: ITWeb, Ampath downplays data breach claims.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.