A threat actor is advertising what he claims is a trove of more than 80 million records tied to Ampath Laboratories, one of South Africa’s largest pathology providers.
The claim surfaced on an underground forum and was flagged by a cybercrime intelligence account on X on October 13. According to the Daily Dark Web report, the seller says the haul covers patient records, admission dates, medical details and South African identity numbers, alongside contact information, human resources files, employee data, financial records and system configuration material. He also says he holds source code and dynamic-link library files.
The seller claims the data was pulled from 10 of 375 databases, which leaves the true scale open to question. No independent verification of the volume or its authenticity exists as of writing, and the report does not explain how the records were counted or whether they came from a single intrusion.
For hospitals and clinical labs, the exposure categories matter more than the headcount. Pathology providers hold diagnostic results, referral correspondence and identity numbers that can seed medical identity theft, where a fraudster uses a real patient’s details to obtain care, prescriptions or billing in their name.
Healthcare organisations should treat unverified forum claims as an early warning rather than a confirmed breach. Practical steps include confirming whether any third-party lab or diagnostics vendor processes your patient data, checking contractual breach-notification clauses, and rehearsing the call path for reaching patients if a supplier confirms an incident.
Ampath has not publicly confirmed the claim. South African regulators and the company’s own incident process would determine any notification obligations if the intrusion is later verified.
