Quest Diagnostics Investigates Unauthorized Access to Patient Records in Quanum System
Summary
Quest Diagnostics says an unauthorized party may have accessed patient records through its Quanum Lab Services Manager system. The company paused access while investigating; it says operations were not materially disrupted.
Key points
- Quest told the SEC it believes an unauthorized party accessed certain patient records through Quanum Lab Services Manager, which healthcare providers use for lab orders and results.
- Quest said the incident remains under investigation and has not materially disrupted operations or its ability to serve patients.
- The company paused access to Quanum Lab Services Manager. Direct-customer LIS and EMR interfaces for ordering tests were not affected.
- Quest said it initiated incident response, containment, investigation and remediation procedures, and notified U.S. federal law enforcement.
- Security experts quoted in the article recommend phishing-resistant MFA, monitoring for unusual searches or bulk retrieval, and limiting what a compromised client account can access.
Article Details
- Victim Organization
- Quest Diagnostics
- Incident Type
- Unauthorized access to the Quanum Lab Services Manager system; Quest said an unauthorized party may have accessed certain patient records. The incident remains under investigation.
- Data Types Exposed
- Certain patient records; specific data types were not disclosed
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Quest paused access to Quanum Lab Services Manager during its investigation. Quest said the incident had not materially disrupted its business operations or its ability to serve patients. Direct-customer LIS interfaces and EMRs used to order testing were reported unaffected.
- Ransom Or Extortion
- No ransom demand or extortion was reported. Security expert Jason Vest characterized data theft and extortion as a possibility based on the reported circumstances.
- Claim Status
- alleged