Short answer
Ampath said it was hit by a cyberattack on 2 October 2026 and that a web server was accessed. A group called ByteToBreach claims it copied 80 million patient records, but Ampath says that figure counts database entries and that it has no evidence that test results or diagnoses were taken.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Ampath Laboratories |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare (pathology laboratories) |
| Country | South Africa |
| Detected | 2026-10-02 |
| Disclosed | 2026-10-13 |
| People or records affected | Unclear. Attackers claim 80 million records; Ampath says that counts database entries, not patients |
What data was exposed
- Names and ID numbers
- Dates of birth, age, sex and language
- Physical and email addresses and mobile numbers
- Medical aid scheme, membership number and option
- Payment details such as payer names, amounts and transaction times
What happened
Ampath, one of South Africa’s largest pathology groups, told the public in mid-October 2026 that it “fell victim to a cyberattack” on 2 October. According to TechCentral, a criminal calling itself ByteToBreach then claimed the attack on an online forum. Dark Web Informer, an account that says it has not verified the claims, reported that the actor copied 10 of about 375 Ampath databases, and that one table alone held more than 80 million records.
The headline figure of more than 80 million records comes from that claim. TechCentral said it had not seen the original post, and the claim has not been independently verified.
The dispute over the number
Ampath did not deny the attack. It said the figure “should not be interpreted as 80 million individual patients” and that it appears to count database entries. A single patient can produce many entries over years of dealing with a healthcare provider, ITWeb reports.
Both outlets note that the real number of people affected is not yet known. Not every record contains every field, according to Ampath.
How Ampath responded
Ampath says it blocked malicious IP addresses, removed unauthorised files, disabled compromised accounts, fixed the vulnerability and restored the affected web server from a clean backup. It reports no evidence of ongoing unauthorised access and no disruption to laboratories or patient care. Independent forensic specialists and legal advisers are working on the investigation.
About the group named
TechCentral cites the threat intelligence firm KELA, which first profiled ByteToBreach in November 2025. KELA assessed the actor as likely an individual based in Algeria and says it has claimed attacks in Seychelles and Nigeria. That is a researcher’s assessment, not a court finding.
What is still unknown
- How many real patients are in the affected databases.
- Whether a ransom was demanded.
- Whether the data has been published.
The pattern matters even if your medical results are safe. ID numbers combined with medical aid membership details give scammers enough to sound convincing on the phone. Read our guides on phishing messages and government and official impersonation scams, and the general checklist in what to do after a data breach. For other recent cases, see the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or WhatsApp messages from fake 'medical aid' or 'Ampath' staff who quote your ID number and scheme name to ask for banking details or a 'refund' fee.
- Fake lab-result messages with a link, built around the fact that you may have had blood tests or other pathology work done.
- Identity fraud attempts, such as loan or account applications in your name, using your ID number and date of birth.
- Extortion emails from people claiming to hold your health data and demanding payment.
What to do if you are affected
- 01Do not reply to, pay or follow instructions from anyone claiming to hold Ampath data. Ampath advises this directly.
- 02Treat unexpected calls and messages about your medical aid or lab results with caution, and never give banking details to an inbound caller. Call your medical aid on the number on your membership card.
- 03Monitor your bank accounts and check your credit report with a South African credit bureau.
- 04Consider free Protective Registration with the Southern African Fraud Prevention Service (SAFPS), which flags applications made in your name.
- 05If you receive a threat or demand about your health data, keep the message and report it to the South African Police Service, and you can lodge a complaint with the Information Regulator.
Frequently asked questions
Were my Ampath test results stolen?
Ampath says it has found no evidence that medical records, diagnoses, pathology test results or banking information were compromised. It describes its findings as subject to forensic verification, so the position could change.
Is it true 80 million patients were affected?
That number is a claim by a group calling itself ByteToBreach. Ampath says it should not be read as 80 million individual patients because one patient can generate many records over the years. TechCentral noted that this does not deny that personal information was affected.
How do I find out if my details were exposed?
Ampath has not published a lookup tool. Under South Africa's POPIA law, organisations must tell affected people once there are reasonable grounds to believe data was accessed, so watch for a direct notice and be careful with messages that arrive unprompted.
Has the regulator been told?
Yes. Ampath says it notified South Africa's Information Regulator under section 22 of POPIA and is cooperating with authorities.
Has Ampath said whether it got a ransom demand?
Not in the statements we read. Ampath has not said whether a ransom was demanded.
Sources
- Ampath breach: no evidence test results taken, TechCentral, 2026-10-14
- Ampath downplays data breach claims, ITWeb, 2026-10-15
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.