A Quest Diagnostics breach has affected patient information held in the company’s Quanum Lab Services Manager system. The medical testing provider confirmed unauthorised access but has not established how many patients the incident involves.
Quest detected the intrusion on October 21 and immediately suspended access to the affected platform. Its investigation involves both patient health information and personally identifiable data.
However, the company says its core operations remain active. Other systems that healthcare providers use to order tests also remain unaffected.
Attackers Accessed Records Through the Quanum Platform
Certain Quest clients use Quanum Lab Services Manager to submit laboratory orders, receive results and review previous results. The platform connects clinical laboratories with physician offices, clinics and hospitals.
In an October 21 regulatory filing, Quest said it believed an unauthorised party had accessed certain patient records.
Nevertheless, investigators are still determining exactly which information the attackers reached. The company has not confirmed whether they copied data out of the system.
It also remains unclear whether ransomware played a role or when the intrusion began.
Quest Diagnostics Breach Leaves Exposure Scale Unclear
Quest performs more than 200 million clinical laboratory tests annually and serves approximately one in three American adults each year.
Its network includes more than 7,700 access points, including roughly 2,000 patient service centres across the United States.
That reach makes the incident potentially significant. However, the company’s overall patient population does not establish the number of people affected by this breach.
Quest says it is identifying the patients and providers involved. It will issue notifications as applicable law requires.
Alternative Ordering Options Remain Available
Although Quest paused access to Quanum Lab Services Manager, it says its core business continues to operate.
The company reported no impact on its other electronic medical record and laboratory information system interfaces. Consequently, healthcare providers can continue ordering tests through those channels.
For affected clients, Quest outlined two temporary alternatives:
- Submit paper test requisitions by fax using the company’s instructions.
- Access Quanum eLabs for orders and results using their existing login credentials.
Meanwhile, Quest is working to restore the affected system fully.
Patient Information Could Support Convincing Scams
Medical information can give criminals material for targeted fraud. For example, a message referencing genuine care details may appear more credible than a generic phishing email.
However, Quest has not yet identified the specific health information involved in this incident. Claims that particular test results or diagnoses leaked would therefore go beyond the available findings.
Unlike a password, a patient’s medical history cannot simply change after an exposure. This makes the scope of access an important part of the ongoing investigation.
External Specialists Assist With Investigation
Quest has notified federal law enforcement and brought in external cybersecurity specialists to support its response.
The company says it has contained the threat. Nevertheless, investigators still need to establish the full extent of access and whether attackers removed patient data.
Quest also said preliminary findings indicate that the incident is unrelated to a PHP programming language issue.
Further updates should clarify the affected records, the number of patients involved and the notification process.
0 responses to “Quest Diagnostics Breach Exposes Patient Records in Lab Management System”