Quest Diagnostics says hackers accessed patient health data through its Quanum lab portal
Quest says patient health information was accessed via Quanum LSM, its test-ordering portal. It hasn't said how many people were affected.
The skim
- Quest Diagnostics, one of the largest US lab-testing companies, says hackers got into Quanum Lab Services Manager, the portal doctors use to order tests and view results, and that patient health information was accessed.
- Quest hasn't said how many patients are affected or what specific data was taken. It says it will notify affected patients and offer credit and identity monitoring.
- This is Quest's second major breach since 2019, when a hack of a third-party billing company exposed 11.9 million patient records.
What happened
Quest learned of unauthorized access to Quanum Lab Services Manager (LSM) on Wednesday, Oct. 21, and disclosed it in an 8-K filing with the SEC, TechCrunch reports. The filing says the access included "certain patient records." Quest says it has notified law enforcement and is investigating.
Quest's security notice, updated as of 8 a.m. ET Friday, goes further. Asked whether protected health information or personally identifiable information was part of the access, Quest answers: "Yes, but we are still investigating to determine the specific data affected." Its patient FAQ says that "personal information and patient records were affected." As TechCrunch first noted, the page carries "noindex" code that keeps it out of search results, which makes it harder for patients to find.
Quest paused access to LSM and says there is no more unauthorized access to the system. It also temporarily paused other tools, including Essential Insights and LabHQ, though it says no data was accessed in those. Quest hasn't said when the breach began or whether anyone has demanded a ransom, and no group had claimed the attack as of Thursday afternoon, The Record reports.
Why it matters
Quanum is used by about half a million clinicians in thousands of locations across North America, according to Quest's own materials cited by TechCrunch. Quest says it serves half of US doctors and hospitals and one in three American adults each year, so even a slice of the system's records could be a lot of people. Lab records can include test results and diagnoses as well as identity and billing details, and that data is valuable to extortion gangs.
The breach adds to a hard year for health tech. TechCrunch lists recent attacks on CareCloud, Craneware and McKesson, and Baylor Genetics recently disclosed a breach affecting more than 2.8 million patients. Congress passed a bill this month expanding federal cybersecurity requirements for healthcare organizations that handle patient data, The Record notes.
Doctors' offices are also dealing with the outage. Quest says practices can order through their own electronic health record or lab interfaces, which weren't affected. LSM users can switch to Quanum eLabs with the same login or fax paper requisitions.
What's next
Quest says it will send notification letters to affected patients once its investigation identifies them, and that the letters will describe available resources, including credit and identity monitoring. There's nothing patients need to do yet. Watch for that letter, and be wary of calls or emails claiming to be from Quest about the breach that ask for personal details. The scale should become clearer when Quest files breach reports with federal health regulators and state attorneys general.
Sources: Quest Diagnostics, TechCrunch, The Record and The Verge.
