Ampath confirmed the cyber attack, saying ID numbers and medical aid details may have been accessed. (Image source: iStock)
Ampath has cautioned against claims that 80 million patient records may have been exposed in a cyber attack, saying the figure being circulated appears to refer to database entries rather than unique individuals.
This, after threat actor ByteToBreach claimed it stole over 80 million patient records from Ampath, one of South Africa's largest pathology labs.
Ampath confirmed the attack, saying ID numbers and medical aid details may have been accessed.
In a statement yesterday, the pathology group says an investigation into the cyber security incident detected on 2 October is continuing, with independent cyber forensic specialists and legal advisers helping to establish the full scope and impact.
Ampath says there is, to date, no evidence that patient medical records, diagnoses, pathology test results or banking information have been compromised.
See also
It notes that the information potentially affected appears to be limited to certain personal demographic and related administrative information, although the company says its findings remain subject to forensic verification.
The group believes the reported figure materially overstates the number of individuals potentially affected, arguing that a single patient can generate multiple database entries over years of registrations, account updates, transactions and other interactions.
It has urged the public to treat claims made by threat actors with caution until they can be independently verified.
Ampath says it activated its incident response protocols immediately after detecting the incident, implementing measures that included blocking malicious IP addresses, restricting access to affected systems, disabling exposed accounts and credentials, removing unauthorised files and restoring affected systems from clean backups.
The company also says it has addressed identified vulnerabilities, strengthened application and access controls, and conducted security testing and vulnerability scans.
According to the company, it has notified the Information Regulator and is cooperating with the relevant authorities.
Ampath says there is no evidence of ongoing unauthorised access and that its laboratories, pathology services and patient care operations remain fully operational, with no disruption to service delivery.
The investigation is continuing, and the company says it will provide further updates as verified information becomes available.
The incident comes amid a series of cyber attacks affecting South African organisations, including businesses that hold sensitive customer information and technology providers that process data on behalf of multiple clients.
In June, technology provider MIP Holdings suffered a cyber attack that exposed personal information linked to customers of about 45 South African insurance companies. MIP provides policy administration and related technology services to insurers and other organisations.
The incident highlighted the risks associated with third-party suppliers, as a breach at a single service provider can potentially expose information associated with multiple businesses and their customers.
In subsequent disclosures, insurers sought to distinguish between an incident at a supplier and a compromise of their own systems. Hollard, for example, said there was no evidence its own IT systems had been hacked, while addressing concerns about information reportedly linked to the MIP incident.
Under the Protection of Personal Information Act, organisations must notify the regulator and affected data subjects when there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. Organisations are also expected to take steps to contain incidents and mitigate potential harm.