South African Lab Ampath Disputes Hackers' Claims of 80 Million Patient Records Stolen
Ampath Laboratories confirmed a cyber incident but disputes threat actors' claims of exfiltrating 80 million patient records, stating no medical data has been compromised.
South African pathology firm Ampath Laboratories has confirmed it is responding to a cybersecurity incident detected on October 2nd, which affected a portion of its IT environment. The company stated that its laboratories, pathology services, and patient care operations remain fully functional with no disruption to service delivery. An investigation, supported by independent cyber forensic specialists and legal advisors, is underway to determine the full scope and impact of the incident.
However, Ampath is disputing claims made by the threat actor group ByteToBreach, which reportedly posted on a dark web forum that it had exfiltrated data from at least 10 Ampath databases. These alleged exfiltrations included employee data, patient information, and a lab admissions table containing 80 million records. ByteToBreach also reportedly claimed to be negotiating a ransom payment with Ampath.
Ampath has strongly contested these claims, urging caution against accepting unverified statements from threat actors. The company emphatically stated that, to date, there is no evidence that patient medical records, health diagnoses, pathology test results, or banking information have been compromised. The figure of 80 million records, Ampath believes, materially overstates the number of individuals potentially affected.
Explaining the discrepancy, Ampath clarified that the "80 million records" figure likely refers to database entries or data rows, not unique individuals. In healthcare settings, a single patient can generate multiple records over time, including administrative, registration, transaction, and test-related entries. Therefore, numerous database records may correspond to a single person.
At this stage, Ampath indicated that the potentially affected information appears limited to certain personal demographic and related administrative data. The ongoing investigation, validated through an independent forensic process, continues to assess the full extent of the breach.
In response to the incident, Ampath implemented extensive containment and remediation measures. These included blocking malicious IP addresses, restricting access to affected systems, enhancing endpoint security, removing unauthorized files, disabling exposed accounts, restoring systems from clean backups, addressing vulnerabilities, and strengthening access controls. Extensive security testing and vulnerability scanning were also conducted.
The attack on Ampath is part of a concerning trend of cyber threats targeting the healthcare sector, particularly pathology laboratories. Recent incidents include a ransomware attack on UK's Synnovis and a breach at US-based Summit Pathology Labs, highlighting the sector's vulnerability to data theft and disruption.
Cybercriminals are increasingly leveraging the threat of public data exposure and the resulting regulatory fines, litigation, and brand damage as leverage. Pathology labs and similar healthcare service providers are becoming frequent targets, with stolen data potentially used for extortion or even in medical research by nation-state actors. The threat actor ByteToBreach has a history of targeting various industries across different geographic regions.