Technology and Scienceupdated 1h ago2 min read
Quest Diagnostics Confirms Unauthorized Access to Quanum Lab Services Manager, Patient Records Exposed
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Unauthorized access to Quanum Lab Services Manager exposed patient health information and personal data. Discovered Oct 21; Quanum LSM access disabled as investigators contain the breach.
Where the coverage agrees
Explore source coverage 3 source types
Directory totals describe our source library, not outlets checked for this story.
Quanum LSM breach confirmed
Quest Diagnostics confirmed unauthorized access to its Quanum Lab Services Manager system, and the company said it learned of the breach on October 21 and deployed its incident response protocol to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures. Quest Diagnostics said the Quanum LSM system is used by certain clients to place test orders, receive and look up results, and the company told regulators it believes some patient records were exposed while the types of data affected have yet to be determined.
Quest Diagnostics said it temporarily paused access to other systems, including Essential Insights and LabHQ, and it stopped the Quanum LSM system while customers were recommended to use paper requisitions or Quanum eLabs to place orders and receive results. Quest Diagnostics also told federal law enforcement authorities and engaged external cybersecurity experts to assist in the investigation and response, while the company said its incident has not disrupted its customer-facing operations and users of direct-customer LIS interfaces or EMRs were not impacted.
Scope remains unknown
Quest Diagnostics told regulators that it discovered the hack on Wednesday and notified federal law enforcement, while the company said how many patients and which particular records have been affected is still unknown. Quest Diagnostics said it believes “certain patient records” were accessed in the breach, but it also said the full scope remains under investigation.
Quest Diagnostics described the unauthorized access as involving patient health information and patient-identifiable information, while the company said the scope of the intrusion is still being determined, including the number of people compromised. Corsica Technologies CISO Ross Filipek warned that depending on what was accessed, “those records could give criminals material for identity fraud or convincing messages about someone’s care,” and he said a scam referencing real test results “can feel far more credible than a generic phishing email.”
Prior breaches and next steps
Quest Diagnostics has faced major patient-data incidents before, including a 2019 breach at American Medical Collection Agency that exposed personal information belonging to about 11.9 million Quest patients. Quest Diagnostics also previously disclosed that a 2016 breach exposed data including lab results and contact information of about 34,000 people, and the company’s latest incident follows those earlier compromises.
Quest Diagnostics said it is working to determine the specific data affected and to identify the impacted patients and providers, while the company said it will make notifications as required by applicable law. Eric Robuck, a professor of cybersecurity at Alvernia University, told WFMZ that “People want that information so that they can sell it or use it against you,” and he said once your data is accessed, “there's not a whole lot you can do about it.”