Key points
- Ampath confirmed a cyber attack on 2 October 2026. ID numbers and medical aid details may have been accessed.
- Under POPIA, your duty to protect personal data and report a breach still applies when the breach happens at a supplier.
- Expect phishing that uses the breach as bait.
- Five practical checks you can start this week are below.
What happened at Ampath
On 2 October 2026, pathology group Ampath detected a cyber attack on part of its IT environment. A criminal group calling itself ByteToBreach later claimed it had taken more than 80 million records.
Ampath has pushed back on that number. It says the figure counts database rows, not people. It also says there is no evidence so far that test results, diagnoses or banking details were taken.
Ampath does say ID numbers and medical aid details may have been accessed. It has notified the Information Regulator and the people affected, and warned them not to engage with anyone who contacts them claiming to hold their data.
Why this is your problem too
You may never have used Ampath. The lesson still applies, because most organisations hold the same kind of data: ID numbers, contact details and account information.
POPIA puts two duties on you that this incident tests:
- Section 19: keep it secure. You must take reasonable technical and organisational measures to protect personal information. “Reasonable” is judged after the fact, by the Information Regulator.
- Section 22: tell people quickly. If you have reasonable grounds to believe data was accessed, you must notify the Regulator and the people affected as soon as reasonably possible.
The bigger risk is often a supplier. Your payroll bureau, cloud host or IT provider may hold your customers’ data. If they are breached, your obligations to those customers do not go away.
There is also a second wave. After a public breach, criminals send phishing messages that mention it to make them look credible. Your staff and clients will receive them.
Five checks to run this week
- List who holds your personal data. Include every supplier that stores or processes it. Confirm each contract has a POPIA clause requiring them to tell you about a breach.
- Check who can reach your databases. Remove old accounts, and turn on multi-factor authentication for every admin login and remote access tool.
- Write down your breach plan. Name who decides, who calls the Information Regulator, and who drafts the notice to clients. Do it before you need it.
- Warn your staff. Tell them to expect phishing that references Ampath or other recent breaches, and to report rather than click.
- Know what “normal” looks like. If no one watches your network logs, an attacker can sit inside for weeks. Monitoring is how you detect a breach early enough to contain it.
For municipalities and regulated bodies
Municipalities hold ratepayer ID numbers, addresses and payment histories, and answer to the Auditor-General as well as the Information Regulator. A breach there is a governance finding, not just an IT incident.
If you are unsure how your organisation would fare, start with the five checks above. If you would like a second opinion, Acorn Technology offers a free network and security assessment, no obligation. You can read more about our cyber security services in Cape Town.
Owen Francis, Managing Director, Acorn Technology