Quest Diagnostics has confirmed that an unauthorized party accessed patient health information on its Quanum Lab Services Manager (LSM) system, a web platform used by clinicians to order lab tests and view results. The company detected the intrusion on October 21 and disclosed it a day later in a Form 8-K regulatory filing.
The confirmation of exposed health data came in stages. Quest’s initial filing said an unauthorized party had accessed “certain patient records” through the Quanum LSM platform, which some clients use to place test orders and look up results. An update posted to Quest’s website went further, stating that patient health information or patient identifiable information was part of the unauthorized access. TechCrunch reported that Quest’s security notice says some patients’ protected health information was taken, including personal information and patient records, and that the company is still determining which specific kinds of data were accessed.
Quest told federal law enforcement after discovering the activity, according to Insurance Journal, and has activated its incident response procedures, including containing the activity and implementing remedial measures. The company has also engaged external cybersecurity experts to assist with the investigation.
Who is affected
The scope of the exposure is still unclear. As of October 23, Quest has not said how many patients or clients had data accessed, and has not yet directly notified affected individuals, according to an AWKO Law notice. Law firm Edelson Lechtzin LLP, which is investigating potential class action claims, said the information involved may include medical records, diagnostic and test-result data, and billing data held in the Quanum platform.
The potential footprint is broad. TechCrunch reported that the Quanum platform is used by roughly half a million clinicians in thousands of locations across North America. BleepingComputer notes that Quest customers using direct LIS interfaces or their own electronic medical record (EMR) connections were not impacted by the incident.
What Quest is doing
Quest has paused access to the Quanum LSM system while the investigation continues. The company also temporarily suspended several other tools used by healthcare professionals whose data was not affected, taken out of caution. The Washington Post reported on that broader shutdown, and BleepingComputer named the affected tools as Essential Insights and LabHQ.
While Quanum LSM is offline, Quest is directing customers to place orders and receive results through paper requisitions or the Quanum eLabs channel, according to BleepingComputer. The company says core business operations and its ability to serve patients have not been materially disrupted, Gizmodo reported. Quest posted an FAQ page about the incident on its website on October 23, according to NJBIZ.
What is still unknown
Many core details remain undisclosed. As of October 23, no threat group had claimed responsibility for the incident, and Quest has not said when the unauthorized access began, how long the intruder had access before detection, or whether any ransom demand was made. The attack vector, any vulnerabilities or misconfigurations exploited, and any role played by third-party systems have not been described in public reports. There is no public information yet on whether stolen data has appeared on leak sites or been used for fraud.
Quest moved to rule out one early theory. The company said in a statement that “Based on our investigation, the incident is not related to a PHP programming language issue,” following the recent disclosure of vulnerabilities in the PHP language.
Quest is no stranger to breaches. CNBC noted that a 2016 incident exposed lab results and contact information of about 34,000 people, and a 2019 breach at a third-party billing company affected personal data of roughly 11.9 million Quest patients.
Legal exposure is already building. Beyond Edelson Lechtzin, AWKO Law said on October 23 it is investigating Quest over the breach and potential claims by affected patients. No regulatory action by the Department of Health and Human Services or state attorneys general has been publicly reported.
One Response