Quest Diagnostics Discloses Cyberattack Affecting Patient Records

Quest Diagnostics disclosed a cybersecurity incident on Thursday, stating that an unauthorized party accessed its Quanum platform, a system used to manage lab test orders and billing. The company confirmed in a filing with the U.S. Securities and Exchange Commission that certain patient records were involved in the breach. Quest stated it has notified law enforcement and is currently investigating the scope of the unauthorized access.

The Quanum platform serves as a critical link between healthcare providers and laboratory services. Quest's own materials indicate that the system is utilized by approximately 500,000 clinicians across thousands of locations throughout North America. It processes requests for lab tests from hospitals and doctors' offices while simultaneously managing associated billing and diagnostic data. Consequently, the system holds a significant volume of medical records and financial information.

The scale of the potential impact remains unclear. Quest has not specified how many patients or healthcare customers were affected by the incident. The company also has not disclosed when the breach began or whether any specific hacking group has contacted the organization regarding the data. A spokesperson for the company declined to answer questions about the incident and referred inquiries to a security notice posted on the website.

That security notice confirms that some patients' protected health information was taken, including personal information and patient records. However, the specific types of data compromised are still under investigation. The notice itself is currently marked with code that prevents search engines from indexing the page, which makes it difficult for individuals searching for the information to locate it via standard web searches.

This event marks the latest in a series of significant cyber incidents targeting the healthcare sector throughout the year. Earlier this year, a cyberattack resulted in the mass-wiping of employee devices at medical technology manufacturer Stryker in March. In August, a hack on medical implant manufacturer Boston Scientific forced the company to take its network offline for weeks, causing disruption to its operations globally.

Other healthcare-related organizations have also faced security breaches this year. Hacks have led to data loss at medical recordkeeping company CareCloud, health tech provider Craneware, and pharmaceutical distribution giant McKesson. These incidents highlight the ongoing threat to health tech companies, which are frequently targeted by financially motivated cybercriminals seeking to steal sensitive data and extort payment in exchange for its release.

This is not the first time Quest Diagnostics has faced a major security incident. The company previously experienced a breach in 2019 involving a third-party billing company, which resulted in the loss of 11.9 million patient records. The current investigation into the Quanum platform breach continues as the company works to determine the specific scope of the data accessed.