Quest Diagnostics data breach hits patient records in lab system

Quest Diagnostics data breach overview:

• Who: Quest Diagnostics disclosed unauthorized access to its Quantum Lab Services Manager (LSM) system.
• Why: Quest believes an unauthorized party accessed certain patient records, including health and identifying information.
• Where: Quest reported the incident in a filing with the U.S. Securities and Exchange Commission (SEC).

Quest Diagnostics has disclosed a data breach involving a system that healthcare providers use to order lab tests and view patient results.

The medical laboratory testing company disclosed that it discovered unauthorized access to its Quantum Lab Services Manager system on Oct. 21, according to an SEC filing released the following day.

“While the full scope of unauthorized access remains under investigation, at this time, the company believes that an unauthorized party accessed certain patient records,” the filing states.

In an online update, Quest confirmed that protected health information or personally identifiable information was part of the unauthorized access. The company is still working to determine the specific data affected. 

The company has not said how many patients were affected by the Quest Diagnostics data breach. It says it is identifying impacted patients and providers and will make notifications as required by law.

Quest stressed that it promptly began its cybersecurity incident response procedures to contain the activity and investigate the scope of the incident.

“The company has notified federal law enforcement authorities and engaged external cybersecurity experts to assist in the investigation and response,” the filing says.

Multiple class action lawsuits filed following Quest Diagnostics data breach

After confirming the unauthorized access, Quest suspended access to its Quanum Lab Services Manager (LSM) system and said no further access had occurred. As a precaution, the company also temporarily suspended two other systems, Essential Insights and LabHQ, although it said neither system had been accessed. Quest expected to restore full service as soon as Oct. 23.

“This incident has not materially disrupted the company’s business operations or its ability to serve patients,” the SEC filing states.

As of Oct. 23, multiple class action lawsuits have been filed in New Jersey federal court concerning the latest data breach. Plaintiffs allege the data is now available on the dark web, with accusations an employee opened a file with a ransomware virus attached.

This is not the first time Quest patient data has been exposed. A 2016 hack exposed lab results and contact information for about 34,000 people, according to media sources. In 2019, a separate breach at American Medical Collection Agency, a billing collections vendor, affected the personal data of about 11.9 million Quest patients, the same sources say.

Have you received a notice about the Quest Diagnostics data breach? Let us know in the comments.

Read About More Class Action Lawsuits & Class Action Settlements:

• Toyota recalls hybrid Land Cruiser SUVs over potential fuel leak hazard, fire risk
• Allulose in ‘Zero Sugar’ syrup sparks Kroger class action lawsuit
• Conduent’s massive data breach leads to proposed $80 million class action settlement
• Farmers Insurance class action lawsuit over interest rates moves forward