Ampath Laboratories data breach
Was I affected?
Ampath Laboratories confirmed a breach affecting an undisclosed number of people, exposing names, national id numbers, dates of birth and addresses. You may be affected if you have had tests done by Ampath, or paid an Ampath account, in South Africa.
| Announced | Oct 13, 2026 |
|---|---|
| When it happened | October 2, 2026 |
| Country | South Africa |
| Data exposed | Names, National ID numbers, Dates of birth, Addresses, Email addresses, Phone numbers, Health insurance details and Bank or financial details |
| Status | Confirmed by the company or a regulator filing |
What happened
Ampath, one of South Africa's largest pathology laboratory groups, said in a notice under section 22 of POPIA on October 13, 2026 that it was hit by a cyberattack on October 2 and that data may have been accessed and taken by a group calling itself ByteToBreach. The data may include names, SA ID numbers, dates of birth, age, sex, language, physical and email addresses, mobile numbers, medical aid details (scheme name, membership number and option) and payment-related information such as payer names, amounts and transaction dates. Ampath says there is no evidence so far that medical records, diagnoses, pathology test results or banking information were taken. The attackers claim more than 80 million records; Ampath says that figure counts database entries, not people, and has not given its own count.
What should I do?
- Be wary of calls, SMSes and emails that quote your ID number or medical aid details and ask for banking information, a payment or a one-time PIN; Ampath says not to engage with anyone claiming to hold its data.
- Ask your medical aid to flag your membership number and check your claim statements for services you did not receive.
- Consider a free SAFPS Protective Registration so lenders run extra checks before opening credit in your ID number.
- Check your credit report with a bureau such as TransUnion or Experian for accounts you do not recognize.
More data breaches in South Africa →
Check the other services you use →
Sources
- Ampath breach: no evidence that test results were taken · TechCentral · news
- Ampath downplays data breach claims · ITWeb · news
- Ampath says data breach claims of “80 million patient records” are overstated · Bizcommunity · news