ByteToBreach says it copied 10 of Ampath Laboratories' 375 databases and more than 80 million records. Ampath confirms a cyberattack but disputes the scale.
What is known and what is not
MyBroadband reported the attacker's claim. The attacker says it took data from 10 databases out of 375, totalling more than 80 million records. Ampath's response, as relayed by ITWeb, TechCentral and BankInfoSecurity, is that the figure counts database entries, not patients. Ampath says it detected and contained the incident on 2 October. Ampath's own statement and its Section 22 notice are quoted at length by MyBroadband, TechCentral, IT-Online and Bizcommunity, and the 2 October date appears in them.
Ampath also notified the Information Regulator under Section 22 of POPIA. That is the step the law requires when personal information may have been accessed by an unauthorised person.
Two details remain unsettled. TechCentral reports that payment information may have been taken, while Ampath says no banking information was compromised. Both positions are reported, and I cannot reconcile them from the public record. Any claim of ransom negotiations comes from the attacker alone, and nothing I have seen confirms it.
The number arrives before the facts
An attacker who publishes a figure sets the first frame. Ampath's reply is that "80 million records" and "80 million patients" are different things. That distinction may well be correct. It is also a hard one to land with the public, because the larger number is simple and the correction needs explaining.
A lab holds health information, which POPIA treats as special personal information. Patients will not wait for a forensic count. They will want to know whether they are affected, and the company's answer needs to survive scrutiny when the full picture emerges.
This is where the Micro, Meso and Macro model helps. At the micro level, the question is what was actually in those 10 databases and how entries map to individual people. At the meso level, it is how the incident team, legal counsel, communications and the Regulator's notification all stay consistent with each other. At the macro level, it is public trust in a sector that holds sensitive data for millions of people, and the regulator's view of how the sector behaves.
Correcting a figure is a governance task
Disputing an attacker's number is a reasonable move. It carries a risk, though. If the company's lower figure later rises, the correction becomes the story. Any statement that downplays scale should be backed by work that can be shown to a regulator, not only by a confident tone.
The difference between records and people is the kind of claim a board should ask to see evidence for. Which systems were examined? Who counted, and how? What would change the answer? Those questions belong in the incident file before they are needed in a press statement.
The payment information discrepancy shows the same point. When two public accounts differ on what was taken, the cause may be wording, timing or an unfinished investigation. Whatever the cause, the company that writes its statement most precisely has the least to retract later. Containment of the incident on 2 October, as Ampath reports it, is good news for the technical response. It does not settle what the company says to patients, and it does not close the Section 22 conversation with the Regulator.
One action for the next board meeting
Boards do not need to predict who will attack them. They can decide how a disputed figure will be handled before one appears.
Ask management to run a tabletop exercise in which an attacker publishes a larger number than the company believes is true. The exercise should end with a written test of the claim, a named owner for the count, and a draft statement that separates records from people and states what is not yet known. Directors should review the output and record who signs off any figure released.
Then check the result against POPIA Section 22. If the exercise cannot produce a defensible number and a consistent account within the time the company would really have, the board has found its gap while it is still cheap to fix.