Cyber criminals say they’ve accessed more than 80m patient records from Ampath Laboratories, one of South Africa’s largest pathology service providers, with ByteToBreach, which has attacked other major entities across Africa, including major targets in Nigeria, claiming responsibility for the breach, reports MyBroadband.
The extortionists announced on a hacker forum on Tuesday that they had successfully compromised the company’s security – and published screenshots of the attack, to prove it.
Ampath has confirmed the attack, saying it had immediately launched an investigation with assistance from external forensic specialists, and that the breach had been successfully contained.
However, its website was taken offline on Tuesday afternoon when MyBroadband visited, displaying a “coming soon” template. By the evening, some functionality had been restored, and the company had added a statement about the cybersecurity incident.
Ampath said that it deemed it prudent to issue the notification because records containing personal information may have been accessed without authorisation.
It said the personal information affected may include name and surname, identity number, date of birth, age, sex, language, physical address, email address, and mobile numbers. Additionally, medical aid information, including the medical aid name, membership number and options, as well as payment-related information, may also have been stolen.
Payment information could also include payer name, internal payment reference number, payment amount, transaction date and transaction time.
Ampath said that it notified the Information Regulator of South Africa in line with Section 22 of the Protection of Personal Information Act.
In the post on the hacker forum, ByteToBreach detailed the extent of the breach and claimed to have negotiated with Ampath regarding a ransom payment.
However, the threat actor said “negotiations were short”, without providing details about how much was demanded or what Ampath’s response was.
It said that 10 out of 375 databases from Ampath “were fully copied, covering HR/employees, multiple patient databases, finances, and other databases containing LDAP and providers”.
The databases “cover the whole period from the mid-2000s to the present day, with the lab’s admission table alone containing more than 80 million records”, it claimed.
ByteToBreach included links to downloads of what is believed to be samples of the data. An online scan of one of these downloads on VirusTotal showed that it was full of malware, including backdoors and trojans.
Ampath said it was working with its cybersecurity specialists to review the available forensic evidence, monitor the environment, and complete the remaining security improvements.
“At present, the available evidence shows no indication of ongoing unauthorised access,” Ampath stated, warning that the unlawfully accessed personal data may have been used to attempt fraud or further security compromises, and that these could include social engineering attacks, impersonation attempts, phishing attacks, and email compromise.
See more from MedicalBrief archives:
NHLS back on track after cyber breach
Cyber hackers target South Africa’s healthcare system
Cyber attacks create havoc in state hospitals in SA, and globally