Quest Diagnostics Breach Hits Its Lab Ordering Platform
Quest Diagnostics says an intruder reached patient records through its Quanum Lab Services Manager platform. It hasn't said how many people are affected.
Quest Diagnostics, one of the largest medical lab companies in the US, says someone got unauthorized access to “certain patient records,” according to an Associated Press report published by SecurityWeek. Quest disclosed the incident in a regulatory filing on Thursday, Oct. 22, a day after discovering it. The intrusion hit Quanum Lab Services Manager, the platform some clients, such as doctors’ offices, use to order tests and get results back. Quest hasn’t said how many patients are affected or which records were exposed.
What’s confirmed so far is thin. Quest says it has brought in outside cybersecurity experts and notified federal law enforcement, and that the investigation is ongoing. It told the AP the breach had nothing to do with the PHP vulnerabilities that dominated security news this week (we covered one of them here). No group has claimed the attack, and the report mentions no ransom demand. The filing doesn’t say how the attacker got in.
This isn’t Quest’s first time. A 2016 breach exposed lab results and contact details for about 34,000 people, and the 2019 hack of billing collector American Medical Collection Agency affected roughly 11.9 million Quest patients.
What it means for you
If you’ve had blood work or other tests done through Quest, or your doctor sends samples to Quest, your records could be involved. Right now nobody outside the company knows how many people that is. Lab records can include your name, date of birth, test orders, results and sometimes insurance details. Criminals use that kind of information for medical identity theft, where someone bills care or prescriptions to your insurance, and for very convincing phishing calls and emails that mention real tests you’ve had. Under US health privacy law, Quest has to notify affected patients, so a letter or email may come in the next few weeks.
Do this now
- Watch the explanation-of-benefits statements from your health insurer and report any visits, tests or prescriptions you don’t recognize.
- Be wary of calls, texts or emails “from Quest” asking you to confirm details or pay a bill. Call Quest back using the number on its official website.
- If Quest’s notice offers free credit or identity monitoring, sign up. Consider a free credit freeze with Equifax, Experian and TransUnion.
- Don’t click links in messages about the breach. Go to Quest’s site directly for updates.