Quest Diagnostics confirms hackers stole patient data from Quanum

Doctors and nurses who rely on Quest Diagnostics’ Quanum platform now know their patient data was accessed by hackers. The company confirmed the breach in a filing with the Securities and Exchange Commission on Thursday. Patients may need to check for notices, as Quest has not yet specified how many people are affected.

Quest said it became aware of the attack on Wednesday. The incident involved Quanum, a system used by doctors' offices and hospitals to order tests and handle billing. The platform stores patient health records, diagnostic data, and billing information. The company stated that unauthorized access included certain patient records.

A security notice on the Quest website says that protected health information was taken. This includes personal information and patient records. The company is still determining which specific data types were stolen. The notice page currently uses code to hide it from search engines, making it harder for the public to find.

Quest has not disclosed how many healthcare customers or patients were impacted. It also did not say when the breach began or if a ransom group made contact. Amanda Rivera, a Quest spokesperson, did not answer questions from TechCrunch and directed reporters to the security notice. The company says it has notified law enforcement and is investigating the incident.

The scale of the exposure is potentially large. Quest materials state that about 500,000 clinicians use Quanum across thousands of locations in North America. A case study on the company's website describes a single health system with over 6 million patients that holds hundreds of millions of medical documents. It is unclear how many records the Quanum system specifically stores.

This is the second major data breach for Quest in a decade. In 2019, the company lost 11.9 million patient records in an attack on a third-party billing company. The healthcare sector has faced several major cyber incidents this year. Attacks on Stryker, Boston Scientific, CareCloud, Craneware, and McKesson have caused disruptions and data thefts. Criminals often steal data to demand ransom payments.

Quest remains one of the largest medical lab testing companies in the United States. The company is continuing its investigation into the Quanum breach. It has not provided a timeline for when it will release more details about the incident.