2026 Ampath Laboratories — confirmed attack; actor claims 80M patient records
Data compromised
Ampath (POPIA s22 notice via MyBroadband): names, ID numbers, DOB, age, sex, language, physical address, email, mobile; medical-aid name/membership/options; payment metadata (payer, internal reference, amount, date/time). Company says no indication that health, diagnostic, or clinical information was in the affected set. ByteToBreach claimed the admissions table alone held well over 80 million records spanning mid-2000s–present — census unverified by Ampath. recordsAffected 80000000 is the actor claim.
Technical writeup
Verified company confirmation (Ampath statement reported by MyBroadband, 13 Oct 2026): cybersecurity incident with reasonable grounds to believe unauthorised access/acquisition of personal information; contained; no ongoing unauthorised access indicated; Information Regulator notified under POPIA s22; website briefly offline then restored with a notice. Fields listed by Ampath are identity/contact/medical-aid/payment — not diagnostic results. ByteToBreach forum post the same day claimed 10/375 DBs fully copied and >80M admission-table rows; sample links reported malware-laden. companyConfirmed true; recordsAffected 80000000 (actor, not Ampath census).
Root cause
Cyberattack on Ampath systems; company says incident contained. Threat actor ByteToBreach claimed 13 Oct 2026 to have copied 10 of 375 databases (HR, patient, finance, LDAP/providers) after short ransom talks.
References
- https://mybroadband.co.za/news/security/672153-attackers-claim-to-have-stolen-80-million-south-african-patient-records-in-massive-ampath-laboratories-data-breach.html
- https://databreaches.net/2026/10/13/attackers-claim-to-have-stolen-80-million-south-african-patient-records-in-massive-ampath-laboratories-data-breach/
- https://www.ampath.co.za/