ByteToBreach claims theft of 10 Ampath Laboratories databases, including 80M+ admission records and South African ID numbers
A threat actor using the handle ByteToBreach claims to have copied 10 databases from Ampath Laboratories, out of an environment said to contain roughly 375 databases. The claimed data includes HR and employee records, multiple patient databases, financial information and system-configuration data. The actor says the laboratory admissions table alone holds more than 80 million records, covering the mid-2000s to the present. The authenticity, source, completeness and record volumes are unverified, and the report documents the actor's claims, not independent confirmation of the data.
Technical Details
- Claimed data fields: admission dates, dates of birth, phone numbers, email addresses, physical addresses, guarantor information, medications and South African ID numbers.
- The actor also claims to hold source code, DLLs, LDAP and provider information, and correspondence with Ampath's information-security team.
- The actor references AS327787 and says the code and libraries could be analyzed for further vulnerabilities.
- Multiple backup and download locations are shown in the source material but are not reproduced in the report.
- No malware hash or attacker-controlled IP address is visible, and the initial access method is not stated.
- The only ATT&CK mapping is Collection via T1213.006 (Data from Information Repositories: Databases), based on the claimed database copying.
Remediation
The article gives no vendor guidance. If the claim is authentic, the combination of patient data, medication data, ID numbers, employee records and internal configuration raises the risk of identity fraud, targeted phishing, extortion and privacy violations, and could enable further compromise of internal infrastructure. Defenders and affected parties should treat the claim as unconfirmed until Ampath or an independent source verifies it.
Linha do tempo
-
ByteToBreach claims theft of 10 Ampath Laboratories databases, including 80M+ admission records and South African ID numbers
ler a análise desta fonte ocultar
A threat actor using the handle ByteToBreach claims to have copied 10 databases from Ampath Laboratories, out of an environment said to contain roughly 375 databases. The claimed data includes HR and employee records, multiple patient databases, financial information and system-configuration data. The actor says the laboratory admissions table alone holds more than 80 million records, covering the mid-2000s to the present. The authenticity, source, completeness and record volumes are unverified, and the report documents the actor's claims, not independent confirmation of the data.
Technical Details
- Claimed data fields: admission dates, dates of birth, phone numbers, email addresses, physical addresses, guarantor information, medications and South African ID numbers.
- The actor also claims to hold source code, DLLs, LDAP and provider information, and correspondence with Ampath's information-security team.
- The actor references AS327787 and says the code and libraries could be analyzed for further vulnerabilities.
- Multiple backup and download locations are shown in the source material but are not reproduced in the report.
- No malware hash or attacker-controlled IP address is visible, and the initial access method is not stated.
- The only ATT&CK mapping is Collection via T1213.006 (Data from Information Repositories: Databases), based on the claimed database copying.
Remediation
The article gives no vendor guidance. If the claim is authentic, the combination of patient data, medication data, ID numbers, employee records and internal configuration raises the risk of identity fraud, targeted phishing, extortion and privacy violations, and could enable further compromise of internal infrastructure. Defenders and affected parties should treat the claim as unconfirmed until Ampath or an independent source verifies it.