Johannesburg – Ampath – one of Southern Africa’s foremost pathology laboratories – has revealed that it recently detected and contained a cybersecurity incident that affected part of its IT environment but warned the number of reported incidents was “overstated”.
The company said an investigation, supported by independent cyber forensic specialists and legal advisers, was ongoing to determine the full scope and impact.
In a statement made available to The Bulrushes on Wednesday, 14 October 2026, Ampath said it “can emphatically confirm that, to date, there is no evidence that patient medical records, health diagnoses, pathology test results or banking information have been compromised”.
At this stage, the information potentially affected appears to be limited to certain personal demographic and related administrative information.
“The investigation remains ongoing, and we continue to validate all findings through an independent forensic process,” the statement said.
Ampath further noted that the alleged claims of “80 million patient records” should not be interpreted as 80 million individual patients.
The publicly cited number appears to refer to database records or entries (data rows) rather than unique individuals.
“In healthcare environments, a single patient may generate multiple records over many years of interactions with a healthcare provider,” explained Ampath.
“These may include administrative records, registrations, account updates, requests, transactions, laboratory-related entries, and other data points associated with that individual.
“Consequently, multiple database records may relate to a single person.”
Ampath said it believes the figure being circulated materially overstates the number of individuals potentially affected.
“We urge caution against accepting unverified claims made by threat actors as a reflection of the actual impact of the incident,” the statement said.
Immediate action taken
Upon detecting the incident, on 2 October 2026, Ampath said it immediately activated its incident response protocols and implemented extensive containment and remediation measures.
This included blocking malicious IP addresses, restricting access to affected systems, implementing additional endpoint security controls, removing unauthorised files, disabling exposed accounts and credentials, restoring affected systems from clean backups, addressing identified vulnerabilities, strengthening application and access controls, and conducting extensive security testing and vulnerability scanning.
Ampath sad it has also notified the Information Regulator and continues to cooperate fully with the relevant authorities.
“There is no evidence of ongoing unauthorised access, and our cybersecurity specialists continue to review forensic evidence and monitor the environment,” the statement said.
“We recognise reports of this nature can cause concern among patients, healthcare professionals, partners and the broader public.
“While we remain committed to transparency, it is important that information shared with the public is based on verified forensic evidence rather than claims made by threat actors, whose statements often cannot be independently verified.”
Ampath said its laboratories, pathology services and patient care operations remain fully functional.
There was no disruption to service delivery, the statement said.
“As the investigation progresses, Ampath will continue to engage transparently with regulators, stakeholders and affected parties and will provide further updates as verified information becomes available.”
