Quest Diagnostics Data Breach Hits Quanum Lab Services Manager Patient Records
Do Son 
On October 21, Quest Diagnostics discovered unauthorized access to its Quanum Lab Services Manager (LSM) system. In a filing with the SEC, the lab giant said it believes “an unauthorized party accessed certain patient records.” The Quest Diagnostics data breach involves both protected health information and personal data, although the company has not said how many patients are affected.
What Is Quanum Lab Services Manager?
Quanum LSM is a web platform that some Quest clients use to order lab tests. Doctors’ offices also use it to receive and look up results. As a result, the system holds sensitive patient data tied to everyday testing.
Once Quest confirmed the intrusion, it cut off access. “Upon discovery of the incident, we paused access to the system and we are continuing to investigate the incident,” the company said.
What Data Was Exposed
Quest has confirmed that patient data was involved. “We believe some patient data within Quanum LSM was accessed, but other systems were not affected,” it wrote in its customer FAQ.
Asked directly whether PHI or PII was part of the access, Quest answered: “Yes, but we are still investigating to determine the specific data affected.” The company has not yet named the exact data types or the number of records.
Other Systems Paused as a Precaution
Quest also paused access to its Essential Insights and LabHQ platforms. However, it stressed that no data was accessed in those systems.
Is This Linked to the PHP Flaw?
The Quest Diagnostics data breach landed in the same week as critical PHP vulnerabilities. Those flaws can let attackers take full control of web servers. Even so, Quest rejected any link. “Based on our investigation, the incident is not related to a PHP programming language issue,” the company said.
Impact on Providers and Patients
Core business operations remain up and running. Moreover, providers that order through EMRs or direct LIS interfaces were not affected.
Meanwhile, Quanum LSM users can switch to Quanum eLabs with the same credentials, or use paper requisitions. Quest expected to restore full service as soon as October 23.
A Familiar Problem for Quest
This is not the company’s first incident. In 2019, a hack at billing vendor American Medical Collection Agency hit about 11.9 million Quest patients. Earlier, a 2016 breach exposed the lab results of about 34,000 people.
What Comes Next
Quest is working with outside cybersecurity experts and law enforcement. “As the covered entity, Quest Diagnostics will make notifications as required by applicable law,” the company said. Patients should therefore watch for official letters and be wary of phishing that cites lab tests.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
