Ampath says 80 million records is overstated. It has not said how ByteToBreach got in.

Ampath Laboratories (Ampath) confirmed that it suffered a cyberattack on 2 October 2026. On 13 October, a threat actor calling itself ByteToBreach reportedly posted on a hacker forum claiming to have stolen more than 80 million patient records, with screenshots offered as proof. Ampath's own statement, reported on 14 October, names the attacker and confirms the incident, but disputes the scale of the claim.

According to the attacker's claim, as relayed by a third party and not independently verified, 10 of Ampath's roughly 375 databases were fully copied. The reportedly affected data spans HR and employee records, patient records, finance data and provider directory data, dating from the mid-2000s to the present. The attacker also claimed that negotiations with Ampath over a ransom were short. No amount has been published and no payment has been confirmed.

Ampath says the 80 million figure should not be read as 80 million individual patients, because one patient can generate many database records over time. It says the data that may have been affected includes names, ID numbers, dates of birth, contact details, addresses, medical aid membership details and payment-related information. It reports no evidence that medical records, diagnoses, pathology test results or banking information were taken. Ampath told customers to watch for phishing and fraudulent requests, particularly about banking details.

The entry route has not been disclosed. Ampath has said only that it removed a vulnerability in application functionality and restored the affected web server from a clean backup. It engaged external forensic specialists, notified South Africa's Information Regulator under Section 22 of the Protection of Personal Information Act, and reports no current sign of ongoing unauthorised access. A scan of one leaked sample file reportedly flagged backdoors and trojans, which raises the question of what else was running inside the environment.

The defences in play here were the ones most organisations rely on: a patched web application, perimeter controls, backups and a forensic retainer. Each of them worked after the fact. The web server was restored, the vulnerability removed and the regulator informed. None of them stood between an unauthorised party and the moment ten databases were read and copied out. A bulk export of HR, patient and finance data is the event that mattered, and nothing required a named person to approve it.

A bulk database export is an execution event. Before any account, service or process can copy a database holding patient, employee or payment data, a confirmation request goes to the named authority on their registered device, requiring biometric confirmation. The data owner approves the export, or it does not leave. The same applies to a change that grants a service account read access to production databases, and to any transfer of a full table to an external destination. Each is a high-impact action with a named owner, and each is gated before it runs.

An attacker exploiting a web application flaw, however capable, cannot produce that confirmation. They do not hold the registered device of the named authority, and they cannot satisfy a biometric check on it through a separate channel. The execution boundary holds regardless of how the attacker got in.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence network for Security, Resilience & Defence teams.

References

1. van Rooyen, F. 2026. Ampath finds no evidence that test results were taken in breach. TechCentral, 14 October 2026.
2. MyBroadband. 2026. Attackers claim to have stolen 80 million South African patient records in massive Ampath Laboratories data breach. MyBroadband, 13 October 2026.