Quest Diagnostics is investigating unauthorized access to its Quanum Lab Services Manager after determining that patient information and records were affected. The clinical laboratory company said it discovered the incident on October 21 and suspended access to the platform, which certain healthcare providers use to order tests, receive results and review prior results. Quest’s incident notice says its core business operations remain active.
The company has not disclosed how many patients or records are involved, nor has it identified the specific information accessed. Quest said its investigation indicates that personal information and patient records were affected, including protected health information and personally identifiable information, but it has not confirmed whether the exposed data included Social Security numbers, insurance identifiers, payment information, passwords or particular test results. The company said it will notify patients, providers and health plans when it determines who was affected and what information was involved.
Quest has not attributed the incident to a threat actor, published a vulnerability or assigned a CVE. It also said the event was not related to the PHP security issue that prompted recent warnings to organizations using the language. There is currently no verified public evidence of a public proof of concept or exploitation in the wild tied to Quanum LSM. Quest said it has engaged law enforcement and continues to investigate the nature and scope of the unauthorized access.
The interruption is limited to the affected workflow rather than Quest’s entire testing operation. Providers using direct laboratory-information-system interfaces or electronic medical records can continue ordering as usual, while Quanum LSM customers can use paper requisitions, Quanum eLabs, phone support or e-fax to place orders and obtain results. Quest said other systems, including Essential Insights and LabHQ, were paused temporarily as a precaution, but that no data was accessed in those systems.
Patients should be wary of unsolicited breach-related messages and independently verify any request for credentials, payment or personal information. They should also review medical bills and insurer explanations of benefits for unfamiliar tests, appointments or claims, and check their credit reports for unexpected accounts. Quest says affected patients will receive notification letters describing available resources, including credit and identity monitoring, after the investigation identifies the impacted population.
