Quest Diagnostics breach hits Quanum lab platform, patient records accessed
Quest Diagnostics has disclosed a breach of its Quanum Lab Services Manager platform, according to SecurityWeek. The medical laboratory operator says it believes certain patient records were accessed, but the number of people and the data involved have not been disclosed. Quest has not said who is behind the intrusion.
What we know
SecurityWeek reports that Quest Diagnostics filed a regulatory notice on Thursday describing unauthorized access to one of its systems. Key points from that reporting:
- The affected system is Quanum Lab Services Manager, a platform where certain clients can place test orders and receive or look up results.
- Quest says it discovered the intrusion on Wednesday and notified federal law enforcement.
- The company is working with external cybersecurity experts as its investigation continues.
- Quest told The Associated Press the breach is not related to the recently reported PHP vulnerability issue, based on its investigation so far.
Who is affected
Quest believes some patient records were accessed. The platform is used by certain clients of the company, so the exposure would most likely involve data tied to test orders and results handled through it. The company has not said which clients, how many patients or which fields (for example names, contact details or lab results) were involved.
The company has faced patient-data incidents before. SecurityWeek notes a 2016 exposure of lab results and contact details for about 34,000 people, and a 2019 incident at a billing collections provider that affected about 11.9 million Quest patients. Those are separate events and do not show what happened here.
What has not been confirmed
- The number of patients and the specific records affected: still under investigation.
- How the attacker gained access and how long they had it: not disclosed.
- Whether data was copied or only viewed: not disclosed.
- The identity or motive of the attacker: not disclosed.
Why this matters
This section is our analysis, not new reporting. Lab platforms that let outside clients order tests and read results are an attractive target because a single portal can hold health data for many people. Organizations that connect to such a portal should treat their own account activity as part of the incident until the vendor says otherwise. Health data cannot be reset the way a password can, so early notification and monitoring matter more than waiting for a final scope statement.
What to do
If your organization is a Quest client that uses Quanum Lab Services Manager:
- Contact your Quest account representative and ask whether your account or your patients’ data is in scope, and what notification duties you may have.
- Review recent sign-in and activity logs for the platform on your side, including unusual users, locations or bulk result lookups, and hunt for them in your identity provider logs.
- Reset credentials and review who holds access to the platform, and enforce multi-factor authentication where it is offered.
- Alert your privacy and compliance teams so they are ready if affected-patient notification is required.
- Watch for phishing or phone scams that reference lab results or Quest, which often follow healthcare breaches.
If you are a patient, watch for official notices from Quest or your provider, and be cautious with unsolicited messages about test results. We will update this story if Quest publishes further details.
