Quest Diagnostics discloses new cyber breach

Quest Diagnostics (DGX) has disclosed a cybersecurity breach involving unauthorized access to its Quanum Lab Services Manager, a system used by health care professionals to order tests and view laboratory results. The company said it learned of the incident on Wednesday and believes that certain patient records were accessed, though the overall scope of the breach has not yet been determined.

In a Thursday regulatory filing, Quest described the event as “unauthorized access” to the platform, which is used by certain clients to place test orders and receive or look up results. The company said it quickly notified federal law enforcement after discovering the hack and has begun an investigation into the impact on patient information.

Quest has stated that the number of patients affected and which specific records were involved remain unknown. The company believes that some patient records were accessed but emphasized that the full extent of the breach is still under investigation. The scope of the incident, including the categories of data potentially exposed, has not been immediately clear.

Following discovery of the breach, Quest paused access to the Quanum Lab Services Manager system. It also halted access to several other tools used by doctors and other health care professionals where data was not impacted, describing these steps as being taken out of an abundance of caution. Outages and limited service have continued for some users while security measures are addressed.

Quest said it is working with external cybersecurity experts to assist in its response and investigation. The company confirmed that, based on its current findings, the cyber breach is not related to recently identified PHP vulnerabilities that have prompted security work across industries.

The company has notified federal law enforcement and is continuing to assess what information may have been compromised. As the inquiry proceeds, Quest is focused on restoring full functionality to its systems while attempting to verify which patient records were accessed and how many individuals may ultimately be affected.

Quest has experienced earlier security incidents involving patient information. In 2016, the company reported that data including lab results and contact information for about 34,000 people was exposed in an online breach. In 2019, personal information for about 11.9 million Quest patients was affected following a separate hack at American Medical Collection Agency, a billing collections service provider.

These prior events underscore that large medical laboratory operators have faced repeated challenges in protecting sensitive patient data. The latest incident adds a new breach specifically involving the Quanum Lab Services Manager platform and has led to immediate operational and investigative actions at Quest.