Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach

Key points

• Quest Diagnostics confirmed a cyberattack on its Quanum lab testing system compromised patient records.
• The company notified law enforcement and is still investigating what specific data was taken.
• Quest has not said how many patients or healthcare customers were affected by the breach.

Quest Diagnostics has confirmed a cyberattack and data breach affecting an unspecified amount of sensitive patient information in its systems, according to a legally required disclosure filed with U.S. regulators. In an 8-K filing with the Securities and Exchange Commission, the lab testing giant said it learned of the attack on Wednesday against Quanum, one of its lab testing systems.

Quanum lets doctor's offices, hospitals and healthcare practices request lab tests for patients and also handles billing. The platform stores a large amount of patient health and medical records along with associated diagnostic and billing data. Quest said the unauthorized access included the viewing of certain patient records, and that it has notified law enforcement and is investigating.

Scope of the breach

Quest has not said how many healthcare customers or patients had information stolen in the attack on Quanum. Its website and materials say Quanum is used by about half a million clinicians in thousands of locations across North America.

In a security notice, Quest said some patients' protected health information was taken, including personal information and patient records, but the company is still investigating what specific kinds of data were taken. Quest did not say when the breach began or whether any hacking group has contacted it with demands. Spokesperson Amanda Rivera did not answer TechCrunch's questions and referred to the security notice.

personal information and patient records

— Quest Diagnostics security notice

A year of healthcare hacks

The Quest attack is the latest major cyber incident to hit the healthcare industry this year. A series of attacks and breaches have caused weeks of disruption and allowed the theft of millions of patient electronic health records and other medical information.

In March, a cyberattack led to the mass-wiping of employee devices at medical tech maker Stryker, and an August hack on medical implant manufacturer Boston Scientific forced its network offline for weeks, causing what the article describes as "global disruption" to its operations. Separate hacks this year caused large patient data breaches at CareCloud, Craneware and McKesson. This is Quest's second known major breach in a decade, after 11.9 million patient records were lost in a 2019 cyberattack on a third-party billing company.