Quest Diagnostics Breach Hits Quanum, Platform Serving 500,000 Clinicians

Quest Diagnostics confirmed Wednesday that a cyberattack compromised its Quanum platform, potentially exposing sensitive health and billing data for patients across North America. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission, stating that unauthorized actors accessed certain patient records. Quanum serves as a critical interface for approximately 500,000 clinicians, facilitating the ordering of tests and the processing of related billing information.

While the company has acknowledged that some protected health information was taken, the specific volume of affected records remains undisclosed. Quest has not specified the number of healthcare customers or patients whose data was accessed, nor has it clarified the precise categories of information compromised. The investigation into the scope and origin of the breach is ongoing, with no current details provided regarding when the unauthorized access began.

The targeted platform, Quanum, stores medical records and diagnostic data, creating a repository of information that could be valuable to bad actors. In a single case study published this year, Quest noted that a health system with over 6 million patients could generate hundreds of millions of related medical documents within the system. This scale suggests the potential for a significant data exposure, even if the company has not yet quantified the number of affected individuals.

Quest has referred to a security notice for further information regarding the incident. The company did not provide a response to inquiries about whether any hacking group has contacted them with demands or if any specific data was exfiltrated. The notice posted by Quest contains code that prevents search engines from indexing the page, which may make it more difficult for users to locate the statement through standard web searches.

The incident at Quest adds to a series of cyberattacks targeting the healthcare sector this year. In March, medical technology maker Stryker experienced an attack that wiped employee devices, and in August, Boston Scientific was forced to take its network offline for weeks. Other organizations, including CareCloud, Craneware, and McKesson, have also reported breaches involving patient data throughout the year.

This is not the first time Quest Diagnostics has faced a significant security incident. In 2019, the company reported a breach involving 11.9 million patient records, which occurred through a third-party billing company. The current incident involves the direct compromise of the Quanum platform, a system integral to clinical operations and record management.

Quest is currently investigating the breach and has not released a timeline for when the investigation will conclude. The company has stated that it notified law enforcement following the discovery of the attack. No further details are available regarding the specific nature of the unauthorized access or the potential impact on patient privacy at this time.