Brief
Ampath says 80 million breach figure misrepresents patient count
The pathology group says the alleged 80 million patient record breach overstates the number of people affected and confirms no health data was accessed.
By Felo News Desk · Published
South Africa's Ampamp pathology provider said on Wednesday that the widely‑circulated claim of an "80 million patient records" breach refers to database entries, not 80 million individual patients.
What happened
Ampath disclosed that it suffered a cyber‑attack on 2 October 2026, naming the threat actor as "ByteToBreach". The attacker claimed to have copied ten of roughly 375 databases, including an admissions table that reportedly held more than 80 million records. Ampath issued a notice under section 22 of the Protection of Personal Information Act on Tuesday, stating that personal demographic and administrative data may have been accessed.
What the reports add
TechCentral notes that the 80 million figure likely reflects the total number of rows in a database table rather than unique patients, because a single patient can generate many records over years of care. The outlet also reports that the threat‑intelligence site Dark Web Informer has not verified the attacker’s claims.
What was said
In its statement, Ampath said, "the figure should not be interpreted as 80 million individual patients" and emphasized that "to date, there is no evidence that patient medical records, health diagnoses, pathology test results or banking information have been compromised". The company warned anyone contacted by individuals claiming to hold Ampath data to "not engage with them, make any payment or follow their instructions".
How it came about
The breach follows increasing scrutiny of ransomware payments in South Africa, a debate highlighted in recent Felo coverage of the country's cyber‑security landscape. Ampath’s earlier report on 14 October detailed the incident, noting that only demographic information was exposed and that the organisation had engaged forensic specialists and the Information Regulator.
Key facts
- Ampath suffered a cyber‑attack on 2 October 2026. (techcentral.co.za)
- The attacker "ByteToBreach" claimed to have copied 10 of about 375 databases. (techcentral.co.za)
- Ampath says the 80 million figure refers to database entries, not individual patients. (techcentral.co.za)
- No evidence exists that medical diagnoses, test results or banking details were compromised. (techcentral.co.za)
- Ampath warned the public not to pay or respond to claims of holding its data. (techcentral.co.za)
Sources
- [1] techcentral.co.za — originally reported as “Ampath finds no evidence that test results were taken in breach”
