Skip to content
securitytabs

LiveUpdated

Quest Diagnostics says patient records exposed in lab services system breach

Quest Diagnostics, a US clinical laboratory company, says an unauthorized party got into an online system its clients use to order lab tests, and some patient records were exposed. Patients have no confirmed steps to take yet; the company's notices are the place to watch.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small clinics or practices that order tests from Quest may use the affected platform. The sources do not yet say which clients are affected or publish any fix or indicators. [1][2]

What to do

  1. Ask Quest whether your account uses Quanum Lab Services Manager and whether your patients' records are involved. [1]
  2. Watch for notices from Quest about affected patients. [2]

Mid-size company

A small IT or security team

What to know

Organizations that place lab orders through Quest should confirm whether they use Quanum LSM. No technical indicators or mitigations have been published in the coverage. [1][3]

What to do

  1. Confirm with Quest whether your organization's users and patient data were affected. [2]
  2. Review who in your organization has access to the Quest ordering platform. [1]

Large enterprise

A security operations team

What to know

Quest says an unauthorized party reached a client-facing ordering platform. The coverage gives no scope, attribution or indicators, so third-party exposure is the main question. [1][2]

What to do

  1. Identify business units and integrations that use Quanum LSM and request scope details from Quest. [1]
  2. Prepare for patient notification questions and track Quest's regulatory filings for updates. [1][3]

What happened

SecurityWeek reports that Quest Diagnostics disclosed in a regulatory filing unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders. BleepingComputer reports the company said a threat actor gained unauthorized access to the system, known as Quanum LSM, and that patient records were exposed. [1][2]

The Record describes Quest as a nationwide lab test company and reports it warned that one of its key systems may have experienced a breach of patient data, wording that is more cautious than BleepingComputer's description of a confirmed exposure. [3][2]

What is not yet known

The articles available do not give the number of people affected, the types of data involved, who is behind the intrusion, or whether any data has been published. SecurityWeek quotes the company as referring to certain patient records rather than all records held by Quest. [1][3][2]

Timeline

  1. BleepingComputer reported that Quest confirmed patient records were exposed. [2]

  2. The Record reported that Quest warned of potential patient data theft from a lab service system. [3]

  3. SecurityWeek reported that Quest Diagnostics told regulators of unauthorized access to its Quanum Lab Services Manager. [1]

Sources

  1. [1]SecurityWeek · Oct 23, 08:25 UTC
    Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’context
  2. [2]BleepingComputer · Oct 23, 16:40 UTC
    Quest Diagnostics confirms data breach exposed patient recordscontext
  3. [3]The Record · Oct 23, 12:52 UTC
    Quest Diagnostics warns of potential data theft after attack on lab service systemcontext