Quest Diagnostics data breach: patient records accessed, and the count is still unknown

A blood test is one of the most private things we share. We hand over a sample, and trust that the result travels safely from the lab to our doctor. This week, that trust was tested: Quest Diagnostics, one of the largest lab testing companies in the United States, confirmed a data breach in a system that carries those orders and results.

The Quest Diagnostics data breach matters because of scale. Quest says it serves one in three adult Americans and half of the country’s doctors and hospitals each year. Even a small slice of that is a lot of people, and right now nobody outside the company knows how big the slice is.

Inside the lab ordering system that was breached

On 21 October, Quest learned of “unauthorized access” to Quanum Lab Services Manager, often shortened to Quanum LSM. In its filing with the US Securities and Exchange Commission, Quest describes it as a system “certain clients use to place test orders, receive and look up results”. Those clients are clinics, hospitals and doctors’ offices, not patients directly.

Quest’s key line in that filing is careful: it “believes that an unauthorized party accessed certain patient records”. In a separate notice for clients, Quest confirmed that patients’ health information or personal details were part of what was accessed, but said it is still working out exactly which details.

The company says it started its incident plan, cut off the access, told federal law enforcement and hired outside security experts. As a precaution, it also paused two other client portals, Essential Insights and LabHQ, while saying no data was accessed in them. By the evening of 23 October, Quest said Quanum LSM and the paused systems were restored and working securely. It says its core business, including serving patients, was not seriously disrupted.

What Quest has not said yet

The open questions are the ones patients care about most. Quest has not said how many people are affected, which details were taken, when the access began or how the intruder got in. No hacking group has publicly claimed the attack so far, and Quest has not named anyone. We won’t guess.

Quest did rule out one theory. It told The Associated Press and Gizmodo that this incident is not related to the PHP security flaw that sent web teams around the world rushing to patch this week.

This is not Quest’s first time in this spot. In 2019, about 11.9 million Quest patients were affected when a billing collections company it used, American Medical Collection Agency, was hacked.

If you have had a Quest test, a few calm steps

Quest says it will contact the patients and providers it finds were affected, and report to regulators. Under US health privacy law, known as HIPAA, a healthcare company must tell affected people without unreasonable delay, and no later than 60 days after it discovers a breach. That letter should say what was involved and what to do.

Until then, in our view, the bigger day-to-day risk is not the breach itself but scams that borrow its name. People are already searching for a “Quest data breach text message”, and that instinct to check is a good one. As general good practice, not advice from Quest:

• Treat any text, email or call about a Quest test, result or bill with care. Don’t tap links or call numbers inside it. Go to Quest’s website or your doctor’s office yourself.
• Read the statements from your health insurer and any medical bills. Look for tests or visits you did not have.
• Never pay someone who offers to “delete” or “protect” your records.

As we saw with the Japan data breach wave, scam messages that use real details often arrive weeks after the headlines fade.

The Quest Diagnostics data breach response: quick containment, slower answers

To be fair to Quest, much of the early response looks steady. It found the problem, disclosed it to the SEC within a day, shut off the access, kept testing running and restored its systems within about two days. Pausing other portals that it says were untouched is a cautious choice, and a sensible one.

The harder part is what comes next. Health data cannot be reset like a password, so the people behind those records need specific answers: what was seen, and what to do about it. In our reading, the real measure of how Quest handles this data breach will be how quickly and plainly Quest tells patients what it finds.

Watch for Quest’s letters to affected patients, an official count of people affected, and any report to US health regulators in the weeks ahead. Until those answers come, a slow, careful look at any message that mentions Quest is time well spent.