Quest Diagnostics has disclosed unauthorized access to its Quanum Lab Services Manager system, warning that an intruder accessed certain patient records. The company said it discovered the incident on Oct. 21 and reported it to federal law enforcement in a Form 8-K filed with the U.S. Securities and Exchange Commission. [18]
Quanum Lab Services Manager is used by some healthcare providers and other clients to place laboratory test orders and receive or review results. Quest has not disclosed how many people are affected, when unauthorized access began, or which categories of information were viewed or taken. In its customer notice, however, the company said its investigation indicates that personal information and patient records were affected. Quest’s incident update says it is still working to identify the affected patients and the specific information involved. [16]
Quest said it immediately activated its cybersecurity incident-response procedures, paused access to Quanum LSM and engaged outside cybersecurity specialists. The company also temporarily paused access to several other tools as a precaution, while saying that no data had been accessed in those systems. The incident has not materially disrupted Quest’s core operations or its ability to serve patients, according to the company’s filing.
Providers using direct laboratory-information-system interfaces or electronic medical records can continue ordering tests through those unaffected connections, Quest said. Quanum LSM customers can use paper requisitions or Quanum eLabs to place orders and receive results while access remains suspended. The company said it was working to restore the affected system, but the timing and final scope of the exposure remained subject to its investigation.
No CVE identifier, vulnerability bulletin, public proof-of-concept exploit or exploitation-in-the-wild report has been tied to the incident, and Quest has not attributed the activity to a named threat actor. That means the disclosure currently describes a confirmed unauthorized-access event rather than a publicly characterized software vulnerability. Healthcare organizations using Quanum should follow Quest’s service updates, review account and interface activity, preserve relevant logs, and prepare to notify affected individuals and regulators once the company establishes what protected health information was involved.
