Ampath breach: attacker claims 80 million records, lab disputes count
Ampath POPIA notice and ByteToBreach claim

Ampath breach: attacker claims 80 million records, lab disputes count

Ampath Laboratories has confirmed a cyberattack detected on 2 October 2026 and has issued a notification under section 22 of the Protection of Personal Information Act. On 14 October the lab said public claims of 80 million patient records overstate the number of people affected.

What happened

Ampath says an unauthorised party accessed personal information. Its notice lists name, identity number, date of birth, age, sex, language, physical address, email, mobile number, medical-aid membership details, and some payment references such as payer name, internal reference, amount, and transaction time. It says there is currently no indication that health, diagnostic, or clinical information was included.

The threat actor ByteToBreach claimed responsibility and said 10 of 375 databases were copied, including HR, patient, finance, and LDAP data going back to the mid-2000s, with one admissions table alone above 80 million rows. Ampath says that number is database entries, not unique patients, and that a single person can generate many rows over years. It says forensic work is still open, the Information Regulator has been notified, and it has no evidence of ongoing unauthorised access. MyBroadband reported that a sample download linked by the actor was flagged as malware.

Who is affected

Patients, staff, and payers whose administrative records sat in the accessed systems. The confirmed field list is enough for identity fraud and medical-aid social engineering even if pathology results were not taken.

  • Anyone who has used Ampath and holds a South African ID number in its administrative systems.
  • Medical schemes and practices that email patients about results, accounts, or membership numbers.
  • Staff whose HR records the actor claims were in the copied set. That claim is not confirmed.

What to do now

Do not open files or links offered as Ampath breach samples, and brief the help desk to treat medical-aid and ID-number lures as hostile. If you process Ampath data as an operator or partner, ask which systems you share and whether credentials or VPN paths into your network were in scope. Patients should watch for SMS and email that quote an identity number or membership number and ask for a password or a payment.

Source: Bizcommunity, 14 October 2026, reporting Ampath's statement. Ampath says 80 million patient-record claims are overstated.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Microsoft seizes YAM Store phishing kits behind 1 billion messages
YAM Store, CoGUI, and Iron Man domain seizure