On 2 October, attackers broke into Ampath Laboratories and may have walked out with patient admin data. Ampath says so itself. The 80M number doing the rounds is another matter: it counts rows in a database, not people, and the fields that did leak are plenty for impersonation. I run AliasFleet, a service for email aliases: one forwarding address per site, so a leak points at its source and you can kill that address without touching your real inbox.
Three mistakes are waiting in this story. The first is reading 80M as a victim count. The second is hearing "no test results, no banking" and relaxing. The third is assuming the file is harmless. It holds admin details, not medical ones. Ampath's own account knocks down all three, if you read it carefully.
What Ampath has confirmed
Ampath is one of South Africa's biggest pathology outfits. Intruders hit it on 2 October 2026. Staff spotted the attack the same day, triggered the response plan, and brought in outside forensic specialists. Ampath says the incident is contained, with no sign of continued unauthorised access. It notified potentially affected data subjects under section 22 of South Africa's Protection of Personal Information Act (POPIA) and informed the Information Regulator. News of the incident surfaced on 13 and 14 October, starting with MyBroadband, then TechCentral, MedicalBrief and PressPortal, which ran Ampath's follow-up statement.
| Settled | Still open |
|---|---|
| Attack date: 2 October 2026, spotted the same day | Entry point, beyond a fixed "vulnerability in application functionality" |
| Containment: incident contained, no sign of ongoing unauthorised access | Whether anything actually left Ampath's systems. Ampath's phrase is "may have been accessed and exfiltrated" |
| Legal steps: section 22 POPIA notification sent, Information Regulator informed | Headcount: Ampath has given no victim count |
| Inquiry: independent forensic specialists and legal advisers involved | Circulation: whether the data has spread, been sold, or fed fraud |
| Contents: the notification's field list, set out below | Attacker claims: 10 of 375 databases, the ransom, the 80M figure |
| Cleanup: malicious IPs blocked, access narrowed, extra endpoint controls, unauthorised files removed, exposed accounts and credentials shut down, systems rebuilt from clean backups, vulnerability patched | HR and employee data: whether it was among what was taken |
The notification's field list is the document that matters most here. I have not seen the notice first-hand, so the list below is Ampath's notification as quoted by MyBroadband and TechCentral, and the two outlets agree on it. Its "may include" wording covers name and surname, identity number, date of birth, age, sex, language, physical address, email address and mobile numbers. It goes on to medical aid membership details: medical aid name, membership number, option. Then payment-related information: payer name, internal payment reference number, payment amount, transaction date and time. Ampath adds a caveat: not all records contain data for all fields.
Read the payment fields with care. The notice lists payment-related admin, while Ampath says there is no evidence banking information was compromised. Those claims sit together without friction. A payment reference number and a transaction amount are billing admin, not bank account details. So the payment fields do not prove bank accounts leaked. And the "no banking" line does not prove nothing financial leaked. Both hold.
Ampath's own warning frames the rest. The company says the unlawfully accessed data may be used to attempt fraud, including social engineering, impersonation, phishing and email compromise. That framing is the right one. Keep it in mind.
Your email was the expendable part
Start with the one field in this leak you could have made expendable: the email address you gave Ampath. A dedicated email alias for the lab, forwarding to your real inbox, changes what the stolen record is worth. Not by much on its own. By a lot in the one place that counts: your inbox.
Walk through the coming phishing wave. The attacker sits on your name, ID number, phone number and email address, plus your medical aid name and membership number. A message turns up that knows all of it and asks you to "confirm" a payment detail or a login. On your real address, that note is tough to separate from a genuine one. The attacker knows everything a genuine sender would know. On an alias used only for Ampath, the same note is suspect at once. No one else had it. Only Ampath and whoever stole Ampath's file ever had that address. The leak-tracing mechanism works exactly this way: a message on the Ampath alias points at its source the second it lands. Kill the alias and the channel goes dead while your real inbox stays clean. The set-up guide takes about two minutes.
Nobody thinks to protect a health provider's inbox. You hand over your ID number, your real email and your phone at reception because the test needs them. Then you forget the account exists. The file stays in a database for years, piling up rows, and it is worth more to an impersonator than a shopping account for one reason: it holds the identity fields a bank or a medical aid would ask for. An alias cannot fix the ID number or the phone number. It takes back the one field that lets the attacker reach you in your inbox, and it names the leak the message came from.
A plain limit applies. An alias guards your email channel. It does nothing for the ID number, the phone number, or the medical-aid details in this file. Those call for the steps in the next section, not a product.
80M rows are not 80M victims
Now the number. It came from the attacker, not from Ampath. A threat actor calling itself ByteToBreach claimed responsibility in a hacker-forum post on 13 October 2026, screenshots attached. It said it had fully copied 10 of 375 Ampath databases, spanning HR and employee data, several patient databases, finances, and databases holding LDAP and provider data. It said the data runs from the mid-2000s to the present day. It said ransom negotiations with Ampath were "short", with no amount given and no Ampath response disclosed. Every one of those claims is unverified. TechCentral reports it has not seen the forum post. The threat-intel site Dark Web Informer says it has not verified the claims.
Behind the headline sits one specific claim: the lab's admission table alone held well over 80 million records. Ampath's reply, in its Wednesday statement carried by BizCommunity and PressPortal, is that the figure counts database records or entries, not unique individuals, and that it materially overstates how many people are affected. The reasoning is straightforward, and it holds for every healthcare breach: a single patient piles up many records across years of visits. Each registration, account update, request, transaction and lab entry adds rows for the same person. A table with 80 million rows can belong to far fewer than 80 million people.
None of that shrinks the breach. It voids the headline number as a victim count. The accurate picture: the number of affected people is unknown, the number of copied rows is an unverified attacker claim, and neither figure should stand in for the other. Any report writing "80 million patients" has already fallen into the exact trap Ampath flagged.
The attacker's post carries a second trap. ByteToBreach attached links to sample downloads of what is believed to be the data. MyBroadband reports that a VirusTotal scan of one download showed it was full of malware, including backdoors and trojans. Stay away from them.
The attacker's sample downloads scan as malware. Never open them, never download them, never engage with anyone claiming to hold Ampath data. Ampath's notice says the same: do not engage, do not pay, do not follow their instructions.
Ampath's own website went dark on the Tuesday afternoon, showing a "coming soon" template when MyBroadband visited. By the evening, some functionality was back. A statement came with it.
If you are an Ampath patient
- Brace for impersonation first, not just a wave of spam. The file holds names, ID numbers, phone numbers, email addresses and medical-aid membership details. The likeliest abuse is a call, SMS or email that already knows who you are and asks you to confirm one more thing. A stranger reading your own details back to you is proving they hold the file, not that they are Ampath.
- Skip the links in any message about this breach. If Ampath reaches out, go to Ampath's own site or ring the number on a document you already hold. The phishing wave will turn up dressed in the incident notice's own language.
- Never deal with anyone claiming to hold Ampath data. No payment, no reply, no following instructions. Ampath's notice says this outright.
- Keep an eye on your bank accounts and pull your credit reports, as Ampath advises. The company says there is no evidence banking information was compromised, yet the leaked identity fields are enough to try fraud against accounts that lean on them.
- Think about free protective registration with the Southern African Fraud Prevention Service. Ampath's notice names it as an option.
- Treat any message about medical aid or payments with extra suspicion. The leaked fields cover medical aid name, membership number and option, plus payment references and amounts. A message quoting your genuine membership number still proves nothing about legitimacy.
- Check Have I Been Pwned once the incident is listed. Then follow the breach-response order of operations.
What comes next
Three questions. First, the headcount: will Ampath swap "may have been affected" for a real number of people, and how far will that number sit from the attacker's 80M rows? Second, circulation: will the dataset surface publicly or for sale, turning a contained incident into a circulating one? Third, the entry point: Ampath says it removed and secured a vulnerability in application functionality and rebuilt the affected web server from a clean backup, but it has not described how the attacker got in. That detail settles whether other South African health providers share the same exposure.
Context helps. ByteToBreach has claimed attacks across Africa, including Seychelles Commercial Bank in 2025 and, in Nigeria this year, Sterling Bank, payments platform Remita and the Corporate Affairs Commission, per TechCentral's reporting on KELA's assessment. South Africa's healthcare sector has been hit before, including a 2024 ransomware attack on the state's National Health Laboratory Service. Ampath is not a one-off. It is the private-sector version of a pattern that already reached the public labs.
The investigation is still running, and the forensic findings will settle how much of the attacker's story stands up. Until then, treat the 80M figure as what it is: an unverified claim about rows. Treat your own file as what it is: a complete impersonation kit that is already out there.
Top comments (0)