Ampath says the claim that 80 million patient records were stolen in a cyberattack on the pathology group refers to database entries, not 80 million people.
In a statement on Wednesday, Ampath said the figure “should not be interpreted as 80 million individual patients” because it appears to refer to database records or entries rather than unique individuals. The statement does not deny that information was affected; it takes issue with how the number has been read.
A single patient can generate many records over years of dealing with a healthcare provider, Ampath said. It believes the circulating figure materially overstates the number of people potentially affected, and urged caution against treating unverified claims by threat actors as a reflection of the incident’s actual impact.
In a notice to affected people issued on Tuesday under section 22 of the Protection of Personal Information Act, Ampath said it “fell victim to a cyberattack” on 2 October. It named the attacker as “a criminal threat actor calling itself ByteToBreach” and said data “may have been accessed and exfiltrated without authorisation”.
The information affected may include names, ID numbers, dates of birth, age, sex, language, physical addresses, e-mail addresses and mobile numbers, according to the notice. It also lists “medical aid membership details (medical aid name, membership number and option)” and “payment-related information”, including payer names, payment amounts and transaction dates and times. “Not all records contain data for all fields,” it says.
“Ampath can emphatically confirm that, to date, there is no evidence that patient medical records, health diagnoses, pathology test results or banking information have been compromised,” the company said on Wednesday. The notice likewise says there is “currently no indication that health, diagnostic or clinical information was contained in the affected data”. It does not list bank account details, though it urges vigilance over requests “for banking and financial information”.
10 of 375 databases
ByteToBreach claimed the attack on an online forum this week. According to threat intelligence site Dark Web Informer, which says it has not verified the claims, the attacker said it had copied 10 of about 375 databases, including HR and employee data, patient databases and financial information, and that an admissions table alone held more than 80 million records. TechCentral has not seen the post.
Ampath has not said whether it received a ransom demand, a question at the centre of the debate over whether South Africa should ban ransomware payments. Its notice tells anyone contacted by a person claiming to hold Ampath data to “not engage with them, make any payment or follow their instructions”.
Ampath said its response included blocking malicious IP addresses, removing unauthorised files, disabling compromised accounts and credentials, “removing and securing the vulnerability in application functionality” and restoring “the affected web server from a clean backup”.
It has notified the Information Regulator and said there is “no evidence of ongoing unauthorised access”.
The notice advises people to treat unexpected calls and messages with caution, monitor their bank accounts, check their credit reports and consider contacting the Southern African Fraud Prevention Service for free protective registration.
Threat intelligence firm KELA, in a profile first published in November 2025, describes “a prolific cybercriminal” active since at least June 2025 who has “sold and leaked sensitive databases from airlines, banks, universities, government entities and other high-value targets”. In a July update, it assessed the actor to be likely an individual based in Algeria.
The actor has been active elsewhere in Africa. In July 2025, ByteToBreach offered client data from Seychelles Commercial Bank for sale on a cybercrime forum, according to Resecurity; the bank confirmed an incident but did not name the attacker. In Nigeria this year, ByteToBreach claimed attacks on Sterling Bank, payments platform Remita and the Corporate Affairs Commission.
South Africa’s healthcare sector has been hit before, including a 2024 ransomware attack on the state’s National Health Laboratory Service. — © 2026 NewsCentral Media
