Quest Diagnostics Discloses Cyberattack Compromising Quanum Platform

Medical laboratory giant Quest Diagnostics has confirmed that a cyberattack compromised its systems, resulting in unauthorized access to certain patient records. The company disclosed the incident in a legally required filing with the U.S. Securities and Exchange Commission on Wednesday, October 22. While Quest acknowledged that specific patient information was accessed, the total number of affected individuals remains unknown, and the investigation into the scope of the breach is ongoing.

The attack targeted Quanum, a Quest platform used by healthcare providers to order lab tests and manage billing operations. Because Quanum stores substantial volumes of health records and diagnostic data, the breach has raised concerns regarding the exposure of sensitive medical information. In a public security notice, Quest stated that the compromised material includes personal details and patient records, though it has not yet specified the exact categories of data involved.

According to the company's disclosure timeline, Quest became aware of the unauthorized activity on Wednesday and immediately notified law enforcement. The company is currently investigating the matter. A spokesperson for Quest declined to comment on specific inquiries regarding the incident, referring instead to the company's official security notice. The company has not disclosed when the breach began or if any threat actors have made contact with demands regarding the stolen data.

The security notice detailing the breach is posted on the Quest website. However, that page contains 'noindex' code, a setting that instructs search engines to exclude the page from results, significantly hindering patients' ability to locate information about the incident through standard searches.

This incident is the latest in a series of significant cyberattacks targeting the healthcare sector this year. Recent months have seen disruptions at other major players in the industry. In March, medical device maker Stryker experienced a cyberattack that resulted in the mass-wiping of employee devices. In August, a hack on Boston Scientific forced the company’s network offline for weeks, disrupting global operations. Other entities targeted this year include CareCloud, Craneware, and McKesson.

Quest Diagnostics is no stranger to security breaches. This is the second major data breach the company has experienced in a decade. In 2019, a cyberattack on a third-party billing company resulted in the loss of 11.9 million patient records. The Quanum platform is utilized by approximately 500,000 clinicians across thousands of locations in North America, highlighting the potential reach of the current compromise.