Johannesburg — Ampath, one of Southern Africa’s foremost pathology laboratories, has detected and contained a cybersecurity incident affecting part of its IT environment and says the number of reported incidents has been “overstated,” according to a statement on 14 October 2026. An investigation supported by independent cyber forensic specialists and legal advisers is under way to determine the full scope and impact.
To date, Ampath “can emphatically confirm that, to date, there is no evidence that patient medical records, health diagnoses, pathology test results or banking information have been compromised.” The company says the information potentially affected appears to be limited to certain personal demographic and related administrative information. “The investigation remains ongoing, and we continue to validate all findings through an independent forensic process,” the statement said.
Ampath says 80 million figure misinterprets database records
Ampath warned that the widely circulated claim of “80 million patient records” should not be taken to mean 80 million individual patients. The company said the publicly cited number appears to refer to database records or entries (data rows) rather than unique individuals. “In healthcare environments, a single patient may generate multiple records over many years of interactions with a healthcare provider,” Ampath explained, citing examples such as administrative records, registrations, account updates, requests, transactions, laboratory-related entries and other data points associated with an individual. “Consequently, multiple database records may relate to a single person.” Ampath said it believes the figure being circulated materially overstates the number of individuals potentially affected and urged caution against accepting unverified claims made by threat actors.
Immediate response and containment measures
Ampath said it detected the incident on 2 October 2026 and immediately activated its incident response protocols, implementing extensive containment and remediation measures. Actions taken included blocking malicious IP addresses, restricting access to affected systems, implementing additional endpoint security controls, removing unauthorised files, disabling exposed accounts and credentials, restoring affected systems from clean backups, addressing identified vulnerabilities, strengthening application and access controls, and conducting extensive security testing and vulnerability scanning.
The company said it has notified the Information Regulator and continues to cooperate fully with the relevant authorities. “There is no evidence of ongoing unauthorised access, and our cybersecurity specialists continue to review forensic evidence and monitor the environment,” the statement said. Ampath also said its laboratories, pathology services and patient care operations remain fully functional and that there was no disruption to service delivery.
“As the investigation progresses, Ampath will continue to engage transparently with regulators, stakeholders and affected parties and will provide further updates as verified information becomes available,” the company said.
