Ampath Laboratories and Summit Pathology Labs: Pathology Lab Confirms Hack, But Disputes Data Theft Claims

Ampath Laboratories Confirms Cyberattack but Disputes Massive Data Theft Claims

South African pathology lab Ampath Laboratories confirmed a cybersecurity incident on October 2 but contested claims by the threat actor ByteToBreach that 80 million patient records were stolen. The company stated that its investigation supported by independent forensic experts and legal advisors is ongoing, though it emphasized that patient care operations remain unaffected.

ByteToBreach, which posted on a dark web forum on October 1, alleged it had exfiltrated data from 10 Ampath databases, including employee and patient information, and was negotiating a ransom. However, Ampath dismissed the 80 million records figure as misleading, clarifying that it likely refers to database entries rather than unique individuals, as a single patient may generate multiple records over time. The company also asserted that no medical records, test results, or banking details had been compromised, with only limited personal and administrative data potentially exposed.

Ampath’s response included containment measures such as blocking malicious IPs, restricting system access, and restoring affected systems from clean backups. The lab’s corporate website was reportedly offline as of October 2.

This incident follows a trend of targeted attacks on pathology labs, including:

• Synnovis (UK, 2024): A Qilin ransomware attack disrupted blood supply operations.
• Summit Pathology Labs (US, 2024): Medusa ransomware exposed 1.8 million records.

Security experts note that cybercriminals increasingly exploit regulatory fines, reputational damage, and litigation risks to pressure victims. Pathology labs, often seen as high-value targets, may also face threats from nation-state actors seeking medical research data.

ByteToBreach has been linked to other recent breaches, including Seychelles Commercial Bank (July 2025) and Romania’s National Agency for Cadastre and Real Estate Publicity. The full scope of the Ampath incident remains under investigation.

Source: https://www.bankinfosecurity.com/pathology-lab-confirms-hack-but-disputes-data-theft-claims-a-33106

Ampath Laboratories cybersecurity rating report: https://www.rankiteo.com/company/ampath-laboratories

AMPATH (American Institute of Pathology and Laboratory Sciences) cybersecurity rating report: https://www.rankiteo.com/company/ampathlabs

"id": "AMPAMP1792038563",
"linkid": "ampath-laboratories, ampathlabs",
"type": "Cyber Attack",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Healthcare',
                        'location': 'South Africa',
                        'name': 'Ampath Laboratories',
                        'type': 'Pathology Lab'}],
 'data_breach': {'data_exfiltration': 'Alleged by threat actor',
                 'number_of_records_exposed': '80 million (disputed; likely '
                                              'database entries rather than '
                                              'unique individuals)',
                 'personally_identifiable_information': 'Potentially exposed',
                 'sensitivity_of_data': 'Limited (no medical records, test '
                                        'results, or banking details)',
                 'type_of_data_compromised': 'Personal and administrative '
                                             'data'},
 'date_detected': '2025-10-02',
 'date_publicly_disclosed': '2025-10-02',
 'description': 'Ampath Laboratories confirmed a cybersecurity incident but '
                'disputed claims by the threat actor ByteToBreach that 80 '
                'million patient records were stolen. The company stated that '
                'its investigation is ongoing and patient care operations '
                'remain unaffected.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage',
            'data_compromised': 'Limited personal and administrative data',
            'legal_liabilities': 'Potential litigation risks',
            'operational_impact': 'Patient care operations unaffected',
            'payment_information_risk': 'No banking details compromised',
            'systems_affected': 'Corporate website, internal databases'},
 'investigation_status': 'Ongoing',
 'motivation': 'Ransom, Data Exfiltration',
 'ransomware': {'data_exfiltration': 'Alleged by threat actor',
                'ransom_demanded': 'Yes (negotiating)'},
 'references': [{'date_accessed': '2025-10-01',
                 'source': 'Dark web forum post by ByteToBreach'}],
 'regulatory_compliance': {'legal_actions': 'Potential litigation risks'},
 'response': {'containment_measures': ['Blocking malicious IPs',
                                       'Restricting system access',
                                       'Restoring affected systems from clean '
                                       'backups'],
              'incident_response_plan_activated': 'Yes',
              'recovery_measures': 'Restoring affected systems from clean '
                                   'backups',
              'third_party_assistance': 'Independent forensic experts and '
                                        'legal advisors'},
 'threat_actor': 'ByteToBreach',
 'title': 'Ampath Laboratories Cyberattack',
 'type': 'Data Breach'}