Quest Diagnostics Says Hackers Accessed Patient Records in Lab System Breach

Quest Diagnostics, one of the largest medical lab testing companies in the country, has confirmed that hackers broke into a system holding patient information.

According to a filing with the Securities and Exchange Commission, the company learned about the unauthorized access on Wednesday. The attack targeted Quanum, a platform used by doctors' offices, hospitals, and healthcare practices to order lab tests and handle billing. Quest stated that the intruders accessed certain patient records. The company has notified law enforcement and is currently looking into the matter.

The specific amount of data taken has not been disclosed. Quest's security notice confirms that some protected health information was taken, including personal details and patient records, though the investigation is still determining exactly what kinds of data were involved. Quest has not provided a timeline for when the breach started or commented on whether any hacking group has made contact regarding the incident. A spokesperson for the company referred questions to the security notice.

Quanum is a widely used platform. According to Quest's website, it is utilized by approximately 500,000 clinicians across thousands of locations in North America. The scale of data stored on such platforms can be significant; a case study on Quest's own site notes that a single health system with more than 6 million patients can generate hundreds of millions of medical documents and charts. This incident follows a string of major cyberattacks targeting the healthcare industry throughout the year. Recent breaches have resulted in the theft of millions of patient electronic health records and other medical information. Cybercriminals often target health tech companies to steal sensitive data and threaten to publish it if they are not paid a ransom.

This year has seen several other attacks in the sector. In March, a cyberattack led to the mass-wiping of employee devices at medical tech maker Stryker. An August hack on medical implant manufacturer Boston Scientific forced its network offline for weeks, causing global disruption to its operations. Other breaches have affected patient data at CareCloud, Craneware, and McKesson. This is the second major data breach involving Quest in a decade. In 2019, the company lost 11.9 million patient records after a third-party billing company was compromised. Quest Diagnostics has not yet said how many patients were affected by the current incident. The company's security notice regarding the breach is currently not indexed by search engines, which may make it harder for patients to locate the page.