Quest Diagnostics pulls Quanum lab system after intrusion
Quest Diagnostics took its Quanum Lab Services Manager offline after an intrusion disclosed in an Oct 22 SEC filing; it believes certain patient records were accessed, scope still under investigation.
Quest Diagnostics took one of its lab-results systems offline after discovering an intrusion, the clinical-lab giant disclosed in a regulatory filing. The company says it believes certain patient records in the system were accessed and is still scoping the breach. The disclosure comes from Quest's Oct 22 SEC filing, with reporting from SecurityWeek and The Record. Quest confirmed the incident to the Associated Press and said it is not related to the PHP vulnerabilities now under mass exploitation.
What's affected
The compromised system is Quanum Lab Services Manager (LSM) — the platform certain clients use to order tests and receive or look up results. Quest took it offline, and paused several other systems as a precaution, after discovering unauthorized access. The company says no other part of its operations was affected and that it is working to restore service, with paper requisitions as the interim workaround.
What was taken
Quest's current statement is narrow and hedged: it believes "certain patient records" within Quanum LSM were accessed, and the full scope is still under investigation. The company has not stated:
- how many individuals are affected,
- which data fields were in the accessed records, or
- the initial-access vector.
No figures should be read into the breach until Quest publishes them. Treat any specific number circulating before then as unverified.
Timeline
- Oct 21 (Wed): Quest discovered the intrusion and notified federal law enforcement.
- Oct 22 (Thu): Quanum LSM taken offline; other systems paused as a precaution; SEC filing published.
Attribution
No group has claimed responsibility and Quest has named no actor. A company spokesperson declined to characterize the incident. There is no public extortion post or data-leak claim at publication.
Action checklist
For organizations that use Quanum LSM:
- Expect an outage. Switch ordering and results retrieval to Quest's interim paper-requisition process until the system is restored.
- Watch for Quest-themed phishing. A paused patient-facing system is a prompt for "verify your results" lures; route any such message to your abuse queue, not to end users.
- Preserve your own access logs for the Quanum LSM integration over the discovery window (Oct 20–22) in case Quest's notification later asks downstream clients to check for anomalous use.
- Hold on patient notification language until Quest states the affected data fields and count — HIPAA breach-notification clocks run on Quest's determination, not on early reporting.
Context
Quest has been here before: in 2019 the AMCA billing-vendor breach exposed data on roughly 11.9 million Quest patients and became a template for third-party-risk litigation in US healthcare. This incident looks different — a Quest-operated results platform rather than a downstream billing contractor — but the pattern holds: the lab-results layer concentrates identity, insurance and clinical data across many provider clients, which keeps it a standing target. The number that matters, once Quest confirms it, is how many provider organizations fed patients through Quanum LSM, because each is its own notification obligation.