Pathology service provider Ampath has confirmed a “cybersecurity incident” that compromised certain personal demographic and related administrative information. However, it has cautioned South Africans against claims made by the threat actor ByteToBreach, which MyBroadband reports has claimed responsibility for the breach.
In a statement, Ampath says it has contained the cybersecurity incident that affected part of its IT environment.
Admin info
It has also launched an investigation, supported by independent cyber forensic specialists and legal advisers, to determine the incident’s full scope and impact.
“Ampath can emphatically confirm that, to date, there is no evidence that patient medical records, health diagnoses, pathology test results or banking information have been compromised,” it says.
“At this stage, the information potentially affected appears limited to certain personal demographic and related administrative information.”
Ampath also cautioned that the alleged claim of “80 million patient records” should not be interpreted as 80 million individual patients.
The publicly cited number appears to refer to database records or entries, not unique individuals, it says.
In healthcare environments, a single patient may generate multiple records over many years of interactions with a provider.
These may include administrative records, registrations, account updates, requests, transactions, laboratory-related entries, and other data points associated with that individual.
As a result, multiple database records may relate to one person.
Ampath believes the figure currently being circulated materially overstates the number of potentially affected individuals and urges caution against accepting unverified claims from threat actors as a reflection of the incident’s actual impact.
Unverified claims
Upon detecting the incident on 2 October 2026, Ampath says it activated its incident response protocols and implemented containment and remediation measures.
These included blocking malicious IP addresses, restricting access to affected systems, implementing additional endpoint security controls, removing unauthorised files, deactivating exposed accounts and credentials, restoring affected systems from clean backups, addressing identified vulnerabilities, and strengthening application and access controls.
Ampath says it notified the Information Regulator and continues to cooperate fully with the relevant authorities.
“There is no evidence of ongoing unauthorised access, and our cybersecurity specialists continue to review forensic evidence and monitor the environment,” it adds.
“We recognise reports of this nature can cause concern among patients, healthcare professionals, partners and the broader public.
“While we remain committed to transparency, it is important that public information is based on verified forensic evidence rather than claims made by threat actors, whose statements often cannot be independently verified.”
