Ampath Laboratories Confirms Cyberattack but Disputes Massive Data Theft Claims South African pathology lab Ampath Laboratories confirmed a cybersecurity incident on October 2 but contested claims by the threat actor ByteToBreach that 80 million patient records were stolen. The company stated that its investigation supported by independent forensic experts and legal advisors is ongoing, though it emphasized that patient care operations remain unaffected. ByteToBreach, which posted on a dark web forum on October 1, alleged it had exfiltrated data from 10 Ampath databases, including employee and patient information, and was negotiating a ransom. However, Ampath dismissed the 80 million records figure as misleading, clarifying that it likely refers to database entries rather than unique individuals, as a single patient may generate multiple records over time. The company also asserted that no medical records, test results, or banking details had been compromised, with only limited personal and administrative data potentially exposed. Ampath’s response included containment measures such as blocking malicious IPs, restricting system access, and restoring affected systems from clean backups. The lab’s corporate website was reportedly offline as of October 2. This incident follows a trend of targeted attacks on pathology labs, including: - Synnovis (UK, 2024): A Qilin ransomware attack disrupted blood supply operations. - Summit Pathology Labs (US, 2024): Medusa ransomware exposed 1.8 million records. Security experts note that cybercriminals increasingly exploit regulatory fines, reputational damage, and litigation risks to pressure victims. Pathology labs, often seen as high-value targets, may also face threats from nation-state actors seeking medical research data. ByteToBreach has been linked to other recent breaches, including Seychelles Commercial Bank (July 2025) and Romania’s National Agency for Cadastre and Real Estate Publicity. The full scope of the Ampath incident remains under investigation.