Ampath, one of the country’s biggest pathology labs, has confirmed that it has been the victim of a cyberattack, but has issued a statement clarifying the claim by hackers that “80-million patient records” have been stolen.
The company says it has contained the incident and that a full investigation is underway to determine the full scope and impact of the incident.
“Ampath can emphatically confirm that, to date, there is no evidence that patient medical records, health diagnoses, pathology test results, or banking information have been compromised,” the company says. “At this stage, the information potentially affected appears to be limited to certain personal demographic and related administrative information. The investigation remains ongoing, and we continue to validate all findings through an independent forensic process.”
As to the number of patient records exposed in the attack reported in various media, Ampath continues: “Ampath further notes that the alleged claims of ’80-million patient records’ should not be interpreted as 80-million individual patients. The publicly-cited number appears to refer to database records or entries (data rows) rather than unique individuals.
“In healthcare environments, a single patient may generate multiple records over many years of interactions with a healthcare provider,” Ampath says. “These may include administrative records, registrations, account updates, requests, transactions, laboratory-related entries, and other data points associated with that individual. Consequently, multiple database records may relate to a single person.”
Upon detecting the incident, on 2 October 2026, Ampath activated its incident response protocols and implemented extensive containment and remediation measures.
These included blocking malicious IP addresses, restricting access to affected systems, implementing additional endpoint security controls, removing unauthorised files, disabling exposed accounts and credentials, restoring affected systems from clean backups, addressing identified vulnerabilities, strengthening application and access controls, and conducting extensive security testing and vulnerability scanning.
Ampath has also notified the Information Regulator and continues to cooperate fully with the relevant authorities.
The company says there is no evidence of ongoing unauthorised access, and cybersecurity specialists continue to review forensic evidence and monitor the environment.
Editor’s note: IT-Online attempted to read Ampath’s advice to customers about the breach. We opened the Ampath site (www.ampath.co.za) and read the paragraph at the top of the page notifying “affected data subjects” of a recent cybersecurity incident involving personal information. Unfortunately, our security software prevented us from clicking through to the full notification, as one of more of the website’s certificates are invalid, so authenticity can’t be guaranteed.