Unauthorized Access Prompts Quest to Shut Down Test Result Platform
Quest Diagnostics shut down a core system used to manage medical test results after discovering unauthorized access. The company warned that it believes some patient data within the Quanum Lab Services Manager platform was accessed during the breach. Quest, which serves half of U.S. doctors and hospitals, paused system access while investigators examine what information was affected. The attack did not exploit recent PHP vulnerabilities, according to the company. No hacking group has claimed responsibility.
System Function and Immediate Response
The compromised platform, Quanum Lab Services Manager, handles medical test orders, result delivery and result lookups for healthcare providers. Quest paused access to the system after detecting the breach and pledged to restore it by Friday.
The company directed customers to use paper requisitions in place of the system. Quest also paused several other systems as a precaution while investigators probe the breach, though no other part of the company was directly impacted by the attack.
Scale of Quest Operations
Quest Diagnostics reported more than eleven billion dollars in revenue last year. The New Jersey company says it serves half of the doctors and hospitals in the United States and one in three American adults each year.
Quest confirmed in its FAQ that investigators believe patient data was accessed but did not specify how many records were affected or what types of information were involved. The company is working with law enforcement to resolve the incident.
Investigation Details
Quest stated that the incident did not involve recent PHP vulnerabilities. A company spokesperson declined to comment on the nature of the incident. No hacking group had taken credit for the attack as of the initial report.
The company published a statement and an FAQ about the cyberattack warning customers that it believes some patient data within the system was accessed. Quest is investigating what patient data was affected by the attack.
Recent Healthcare Sector Incidents
Quest is one of several healthcare testing firms to report cyber incidents this year. Baylor Genetics recently disclosed that a data breach impacted more than 2.8 million of its patients and exposed lab results, medical testing information and Social Security numbers.
Several other electronic health records companies dealt with attacks this year. Congress passed a bill this month expanding federal cyber requirements for healthcare organizations that handle patient data, responding to attacks over the last two years.
Risks to Patient Information
If attackers accessed patient data from Quanum, they could potentially view lab results, patient identifiers and information tied to medical tests. Lab results can reveal diagnoses and conditions.
Patients whose information was stored in the system should watch for notification letters from Quest specifying what data was involved. Patients can request copies of their records from Quest to confirm what information the company holds.
Steps for Healthcare Providers
Healthcare providers relying on Quanum should confirm with Quest when the platform will be fully operational. Practices should verify that results from paper requisitions reach the correct clinician.
Providers should review access logs for their own patient record systems to ensure attackers did not use compromised credentials to move into hospital networks. Any unusual login attempts or data exports during the breach window should be investigated.
- Confirm with Quest when the platform will be fully operational
- Verify that paper requisition results reach the correct clinician
- Review access logs for your own patient record systems
- Investigate any unusual login attempts during the breach window
Questions readers ask
What patient data does Quest believe was accessed?
Quest stated in its FAQ that it believes some patient data within the Quanum Lab Services Manager system was accessed during the breach. The company is investigating what patient data was affected. It has not disclosed the number of patients involved or the specific data types accessed.
Can doctors still order lab tests while the system is offline?
Yes. Quest directed healthcare providers to use paper requisitions while the Quanum Lab Services Manager remains offline. The company pledged to have the system back up and running by Friday.
Has any group claimed responsibility for the attack?
No hacking group had taken credit for the incident as of the initial report. Quest declined to comment on the nature of the incident.
What should I do if I recently had lab work at Quest?
Watch for notification letters from Quest that will specify what data was involved. Monitor your credit reports for new accounts or inquiries you did not authorize. Watch for unexpected medical bills or insurance claims. Contact Quest directly if you want to confirm whether your records were stored in the compromised system.
Did the attack exploit PHP vulnerabilities?
No. Quest noted in its release that the incident did not involve recent PHP vulnerabilities that have caused concern among cybersecurity experts.
Source and reporting limits
Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.