3rd Party Risk Management,
Data Breach Notification,
Data Privacy
South African Ampath Laboratories Questions Hackers’ Claims of 80 Million Stolen Patient Records
In a significant development, Ampath Laboratories, a prominent South African pathology laboratory, acknowledged on October 2 its response to a cyber incident, yet it contests the extent of the data theft purportedly claimed by hackers. These recent events mark yet another alarming trend of cyberattacks targeting medical laboratories worldwide.
In an official statement, Ampath Laboratories clarified that an investigation—backed by independent cyber forensic specialists and legal advisors—is underway to assess the full scope and impact of the incident. The company aims to fully understand the implications of the reported breach.
Despite the alarming claims made by the threat actor, Ampath assured its stakeholders that all laboratory, pathology services, and patient care operations remain fully functional, emphasizing that there has been no disruption in service delivery. Nonetheless, curious stakeholders noted that the company’s corporate website appeared to be offline at the time of the incident.
Cybercriminals, identifying themselves as ByteToBreach, allegedly announced on a dark web forum that they had successfully breached at least ten Ampath databases. They claimed to possess sensitive information, including employee data, patient records, and a lab admissions table comprising a staggering 80 million records.
According to their posts, ByteToBreach claimed to be negotiating a ransom with Ampath; however, no agreement had yet been apparently reached. Ampath Laboratories promptly countered these assertions, expressing skepticism regarding the figures circulated by the hackers. The company affirmed that these claims significantly overstate the number of individuals affected and cautioned against accepting unverified information from threat actors as an accurate reflection of the incident’s true impact.
In their statement, Ampath maintained that there is no evidence that patient medical records, health diagnoses, or financial information have been compromised. They also clarified that the figure of 80 million records should not be interpreted as representing 80 million unique individuals. Instead, the lab elucidated that in healthcare environments, a single patient can generate multiple records due to various interactions with healthcare providers over time.
This context is crucial, as medical records can include administrative, registration, and transaction entries, which may all contribute to the total count of records held within a database. Therefore, the notion that all these entries correspond to distinct patients is misleading, according to Ampath’s explanation.
At present, it seems that the scope of the information potentially compromised may be limited to certain personal demographic data and related administrative information. The investigation continues, with Ampath fully validating all findings through an independent forensic process.
In the wake of the incident, Ampath has purportedly undertaken extensive containment measures to mitigate any further damage. These steps include blocking malicious IP addresses, restricting access to compromised systems, and implementing additional endpoint security controls. They have also taken proactive measures to restore affected systems from clean backups while addressing identified security vulnerabilities. Extensive security testing and vulnerability scanning are ongoing to ensure the robustness of their systems moving forward.
Other Medical Lab Attacks
The recent breach at Ampath Laboratories is part of a worrying trend that has seen numerous attacks targeting medical labs across the globe in recent years. One notable example includes a ransomware attack carried out by the Russian-speaking cybercrime group Qilin on British pathology lab Synnovis. This attack significantly disrupted blood supply activities in the U.K. for several months in 2024.
Similarly, the Medusa ransomware gang was responsible for an attack on U.S.-based Summit Pathology Labs, affecting the personal information of approximately 1.8 million individuals.
According to cybersecurity expert Mike Hamilton, cybercriminals have meticulously studied breach laws worldwide and now exploit vulnerabilities where they can exert the most pressure. He states that the financial incentives are increasingly tied not to the sale of records, but rather to the threats posed by releasing sensitive information, thereby inducing regulatory fines, civil litigation, and damaged reputations.
Hamilton further explains that smaller healthcare providers, including pathology labs and medical imaging companies, face increased risks as they become targets for extortion over stolen data.
The implications of stolen pathology data can extend beyond individual patient security, as such information may also be utilized in medical research. In some instances, nation-state hackers have been known to leverage stolen data to expedite their research projects.
ByteToBreach, the alleged culprit behind the Ampath hack, appears to have a diverse target pool, striking various industries across multiple geographic regions, including incidents in other African nations. For instance, in July 2025, they reportedly breached Seychelles Commercial Bank, a small banking institution in the Seychelles.
Additionally, Kela, a security research firm, has tracked a breach claimed by ByteToBreach that targeted Romania’s National Agency for Cadastre and Real Estate Publicity, indicating the group’s broad operational reach.