The Quest Diagnostics breach reached Quanum, the system that doctors’ offices and hospitals use to order lab tests for patients and handle billing. Quest has confirmed that attackers took some patient records. It has not said how many people are affected.
The details below come from TechCrunch’s report, which draws on Quest’s filing with the Securities and Exchange Commission and a security notice on the company’s website. We have not reviewed those documents directly.
What Quest has confirmed
Quest told regulators in an 8-K filing that it learned of the attack on a Wednesday. The report does not give the exact date. The company says the attackers got unauthorized access to “certain patient records,” and its security notice says some patients’ protected health information was taken, including personal information and patient records.
Quest says it has notified law enforcement and is investigating. It is still working out which specific types of data were taken. It has not said when the breach began, and it has not said whether any hacking group has made demands, such as a ransom.
A Quest spokesperson, Amanda Rivera, did not answer TechCrunch’s questions and referred reporters to the security notice. TechCrunch also found that the notice page carried “noindex” code, which tells search engines not to list it. That makes it harder to find with a web search.
Why Quanum matters
Quanum is not a single lab or a single hospital. Quest’s own materials say about half a million clinicians in thousands of locations across North America use it. Doctors use it to request tests for their patients, and practices use it to handle billing, so it holds health and medical records alongside diagnostic and billing data.
The report says it is unclear how many records Quanum holds. It cites a Quest case study describing one health system with more than 6 million patients and hundreds of millions of medical documents. That points to the scale of data in the system, but it does not confirm the size of this breach.
Not Quest’s first breach
In 2019, a cyberattack on a third-party billing company exposed 11.9 million Quest patient records. TechCrunch describes the new incident as part of a run of healthcare cyberattacks this year. It lists Stryker in March, where employee devices were wiped, and Boston Scientific in August, when the network was offline for weeks. It also lists breaches involving patient data at CareCloud, Craneware and McKesson. Our earlier coverage of a different supply-chain attack, the ConnectWise breach, shows how one vendor’s compromise can spread to many customers.
What patients can do now
Quest’s notice, as TechCrunch describes it, does not give specific steps for patients, and the company has not said who will be notified. The points below are general precautions, not guidance from Quest.
- Read Quest’s security notice at questdiagnostics.com/links/quanum-notice, and watch for an official letter or email.
- Review the explanation-of-benefits statements your insurer sends, and flag any service you did not receive.
- Treat unexpected calls, texts or emails about your lab results or billing with suspicion, even if they mention real details.
- Do not click links in messages that claim to be from Quest. Go to the company’s site directly.
If something does go wrong, our guide on what to do if you were scammed lays out the recovery steps in order.
Editor’s take
The open questions matter more than the confirmed facts right now. Quest has not said how many people are affected or what was taken, and a notice that search engines are told to ignore does not help anyone who is trying to find out. We would watch for three things: an updated count, a notification letter from Quest or your doctor’s office, and any word on whether the attackers are demanding payment. Until then, a lab or billing message that arrives out of the blue deserves a second look.
