A breach of Quest Diagnostics’ laboratory ordering system has left patients and healthcare providers waiting to learn which records were exposed.
The laboratory operator disclosed on Oct. 22 that it discovered unauthorized access to its Quanum Lab Services Manager system the previous day. Quest believes some patient records were accessed, but the number of affected people and the specific records involved remain unknown.
For practices using Quanum LSM, the immediate challenge is keeping laboratory orders and results moving while waiting to learn which patients and types of information were affected.
What Quest has confirmed
In its SEC filing, Quest said it activated its cybersecurity incident response procedures, notified federal law enforcement, and engaged outside cybersecurity experts. The company said the incident had not materially disrupted its business operations or ability to serve patients.
The disclosure does not establish that Social Security numbers, financial information, or particular test results were exposed. The full scope of the unauthorized access remains under investigation, according to AP’s reporting.
That distinction matters because the information involved will shape patients’ risks and protective steps. Previous healthcare incidents, including the TriZetto breach and resulting lawsuits, have highlighted concerns about the timeliness and clarity of breach notifications.
Why patient information can create lasting risks
Ross Filipek, CISO at Corsica Technologies, said the potential consequences depend on what the investigation finds.
“Quest’s Quanum platform sits at a sensitive intersection of patient information and everyday lab work. Depending on what was accessed, those records could give criminals material for identity fraud or convincing messages about someone’s care. A scam referencing a real test can feel far more credible than a generic phishing email, and patients can’t simply replace their medical history after an exposure,” Filipek said.
Those are potential risks, rather than confirmed outcomes of this incident. The available disclosures do not establish that criminals have used the affected records for fraud or targeted scams.
Patients should verify unexpected messages about test results, account recovery, or breach assistance through an established provider contact before submitting personal information. As recent Microsoft 365 calendar phishing campaigns illustrate, familiar-looking communications can become vehicles for credential theft.
What remains available to providers
Quest paused access to Quanum LSM after discovering the unauthorized activity. In its incident notice, the company said its core business operations remained running.
Providers using direct-customer laboratory information system (LIS) interfaces or electronic medical records (EMRs) can continue placing orders through those connections, which Quest said were unaffected.
Quest said it anticipated restoring full-service functionality as soon as Oct. 23, but that estimate does not confirm service has resumed. Affected Quanum LSM customers can use paper requisitions or Quanum eLabs to place orders and receive results. Quest also lists telephone and eFax options for obtaining results.
Practices affected by the pause should confirm available workflows directly with Quest and track outstanding orders and results. Their incident response plan should assign responsibility for continuity, communications, and patient inquiries alongside technical investigation.
Keep care moving while reviewing access
For healthcare security teams, restoring service and investigating patient-data exposure require separate follow-through. A functioning ordering connection does not establish which records an intruder accessed or resolve the need for patient communications.
“For healthcare organizations, the practical lesson is to examine how much patient information each account can reach,” Filipek said. “Monitoring needs to catch unusual access before a legitimate workflow becomes a route to records.”
Organizations using Quanum LSM should identify affected workflows, document any interim arrangements, and designate someone to review Quest’s updates. Security and privacy teams should seek affected-account details, access dates, and data categories as findings become available. Those facts can guide access reviews and determine whether further investigation or protective action is needed.
Patients should follow verified updates without assuming every Quest customer was affected. The next meaningful development is a clearer account of whose information was accessed and what it contained. Until then, providers should maintain continuity and prepare to act on specific findings, while patients verify communications and follow up on outstanding tests.
Read more: The DentaQuest breach affected 15 million people and shows why the combination of exposed health and identity information matters.