South African pathology group Ampath Laboratories has confirmed a cyber attack in which patient and payment details may have been taken, while it disputes an extortion gang’s boast of 80 million stolen records. For UK healthcare suppliers still feeling the after-effects of Synnovis, it is another reminder that laboratories make lucrative extortion targets.
What happened
Ampath, one of South Africa’s largest private pathology providers, says it detected a cyber security incident on 2 October 2026 that affected part of its IT environment. The company says it contained the intrusion quickly and brought in independent forensic specialists and legal advisers to establish its full scope.
The incident became public on Tuesday 13 October. A threat actor calling itself ByteToBreach used a hacker forum to claim the breach, posting screenshots and links to what it said were data samples. That same day Ampath issued a formal notice to affected people under section 22 of South Africa’s Protection of Personal Information Act (POPIA), confirming that personal information “may have been accessed and exfiltrated” and that the Information Regulator had been notified.
On Wednesday 14 October Ampath issued a further statement taking aim at the headline number. ByteToBreach says one admissions table contained over 80 million entries. Ampath counters that the figure appears to count database rows rather than people, and that it “materially overstates the number of individuals potentially affected”. Its laboratories have kept running throughout.
The technical picture
According to the forum post, which has not been independently verified, ByteToBreach fully copied 10 of Ampath’s roughly 375 databases. It says these covered HR and employee data, several patient databases, finance systems, and stores holding LDAP directory and provider information, with records going back to the mid-2000s. The actor also said it had held brief ransom negotiations with Ampath, but gave no amount. Ampath has not said whether a ransom was demanded.
Ampath’s own notice gives a narrower but still significant list of data that may be exposed: names, South African ID numbers, dates of birth, age, sex, preferred language, physical and email addresses, and mobile numbers. It also lists medical aid scheme names, membership numbers and plan options, plus payment-related fields such as payer name, internal payment reference, amount and transaction time. The company says it has found no evidence so far that medical records, diagnoses, pathology results or bank account details were compromised.
The remediation steps Ampath has listed point to how the attackers got in. They include fixing a vulnerability in application functionality, restoring an affected web server from a clean backup, removing unauthorised files, blocking malicious IP addresses and disabling compromised accounts and credentials. That pattern fits a compromised internet-facing web application used as a foothold, with harvested credentials then used to reach back-end databases. Ampath has not confirmed the entry point.
MyBroadband reported that when one of ByteToBreach’s sample downloads was submitted to VirusTotal, it was flagged as containing malware, including backdoors and trojans. Journalists, researchers and incident responders routinely download such samples, so a booby-trapped archive becomes a second attack vector.
Threat intelligence firm KELA describes ByteToBreach as a prolific seller and leaker of stolen databases, active since at least June 2025 and probably a single individual based in Algeria. Earlier claims attributed to it include Seychelles Commercial Bank, Nigeria’s Sterling Bank and Romania’s national cadastre agency.
Why it matters for UK organisations
The obvious parallel is Synnovis. The June 2024 Qilin ransomware attack on the pathology partnership serving several south-east London NHS trusts disrupted blood testing and transfusions for months and led to large-scale data theft. Ampath seems to have avoided that operational collapse, but the economics are the same. Pathology providers hold rich, long-lived identity and insurance data for huge patient populations, and they sit in the supply chain of hospitals and clinics that cannot easily switch suppliers.
Mike Hamilton, CISO emeritus at Datec, told ISMG that extortion now leans on regulatory exposure: “The money is no longer concentrated in the sale of records.” That should resonate in the UK, where an inflated record count published by a criminal can drive headlines, regulator interest and class-action marketing long before the forensic facts are in.
The records-versus-people argument matters here too. Under UK GDPR, a controller has 72 hours from becoming aware of a notifiable breach to report it to the ICO, often before it knows how many individuals are affected. Being able to quickly turn “rows exfiltrated” into “unique data subjects affected” is a capability few organisations have tested, and Ampath is now having to show it in public.
The exposed fields, from ID numbers to insurer membership details, are a ready-made kit for convincing phishing, and UK private healthcare providers and NHS suppliers hold comparable data.
Expert view
In my experience, the most dangerous systems in a healthcare estate are rarely the clinical platforms everyone worries about. More often it is a customer-facing portal, a results-lookup page or a payments front end, built quickly, rarely re-tested and connected to far more of the back end than its function needs. When we test those applications, the finding that matters is seldom the initial bug. It is how far a service account or stored credential lets you travel afterwards, and whether anyone notices when it does.
I would also urge caution on both sets of numbers. Attackers inflate figures to raise pressure; victims frame early statements narrowly. Only reconciling the stolen tables against unique identifiers will settle it. Ampath’s distinction between rows and people is technically sound, but if the claim of 10 complete databases spanning nearly two decades holds, that is serious whatever the final head count.
What to do now
- Inventory and test internet-facing applications. Prioritise patient portals, results and payment pages for authenticated penetration testing, and patch promptly (Cyber Essentials: security update management, secure configuration).
- Cut what a compromised web tier can reach. Segment application servers from core databases, give service accounts the least privilege they need and rotate their credentials (Cyber Essentials: user access control, firewalls).
- Watch for bulk data movement. Alert on unusual database export volumes and outbound transfers from web and database hosts, so theft is spotted in hours, not after a forum post.
- Rehearse the row-to-person calculation. Make sure your breach response team can quickly map exfiltrated tables to unique data subjects, to support accurate ICO notification within 72 hours.
- Handle leak samples safely. Download extortion material only into isolated sandboxes, never onto production or analyst workstations.
- Press your suppliers. Ask pathology, diagnostics and billing partners how they segment patient data, how quickly they would notify you, and when they last had their external applications independently tested.
- Warn patients and staff about follow-on fraud. Expect phishing that quotes genuine ID or membership details, and say so clearly.
Bottom line
Ampath’s attack is a South African incident with a familiar shape for UK readers: a laboratory provider, a probable web application foothold, claimed bulk database theft and a criminal whose numbers the victim says are inflated. The disputed 80 million figure will dominate the headlines, but the lesson for UK healthcare is quieter. Know what your exposed applications can reach, be able to count the people behind your records, and hold your diagnostic suppliers to the same standard.
Sources
- MyBroadband: Attackers claim to have stolen 80 million South African patient records in massive Ampath Laboratories data breach
- MedicalBrief: Cyber thieves access 80m Ampath patient records
- TechCentral: Ampath finds no evidence that test results were taken in breach
- Bizcommunity: Ampath says data breach claims of “80 million patient records” are overstated
- GovInfoSecurity (ISMG): Pathology Lab Confirms Hack, But Disputes Data Theft Claims
- Cape Town Etc: Ampath disputes claims of 80 million patient records exposed
