Circuit Wire — a daily news update from the Circuit.
Quest Diagnostics said on October 23 that an attacker gained unauthorized access to Quanum LSM, the online system doctors use to order lab tests, and that some patient records were exposed, BleepingComputer reported.
The company disclosed the incident in a filing with the SEC and posted a notice on its website. It learned of the intrusion on October 21 and activated its incident response protocol. Quest has not said how many people are affected or which types of data were taken. It has also not said when the intrusion began or how the attacker got in. No group has claimed responsibility, according to BleepingComputer.
Quanum LSM, short for Lab Services Manager, lets physicians, hospital staff and medical office workers order tests, view results, track status and order supplies. TechCrunch reported that the wider Quanum platform is used by about half a million clinicians across thousands of locations in North America.
Quest stopped the Quanum LSM system and temporarily paused access to two other services, Essential Insights and LabHQ, as a precaution. Customers have been told to use paper requisitions or Quanum eLabs to place orders and receive results. The company says customer-facing operations were not disrupted and that users of direct-customer LIS interfaces or EMRs were not affected. External experts are assisting the investigation, and law enforcement has been notified.
A Quest spokesperson did not answer TechCrunch's questions and pointed to the company's security notice. That notice page carries code that keeps it out of search results, TechCrunch noted.
Quest operates about 7,700 locations in North America, employs about 65,000 people and reports more than $11 billion in annual revenue. This is not its first major breach. In 2019, an attack on billing collector American Medical Collection Agency exposed data on about 11.9 million Quest patients. At least 19 class-action lawsuits followed, and they were consolidated into a multidistrict litigation that remains unresolved.
TechCrunch places the latest incident among a run of healthcare cyber incidents this year, including attacks on Stryker in March and Boston Scientific in August, as well as CareCloud, Craneware and McKesson.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.