Quest Diagnostics, one of the largest clinical laboratory companies in the United States, said it learned on October 21 that someone had gained unauthorized access to its Quanum Lab Services Manager (LSM) system. Quanum LSM is the online platform that clinics, hospitals and medical offices use to place test orders, look up results and track status. In a filing with the U.S. Securities and Exchange Commission, the company said it activated its incident response protocol to contain the activity and investigate. BleepingComputer reports that Quest believes some patient records were exposed, but the types of data involved have not been determined.
Quest paused access to Quanum LSM and, as a precaution, temporarily paused other systems including Essential Insights and LabHQ. Its notice says no data was accessed in those other systems. Quest says providers that order through direct-customer LIS interfaces or EMRs were not affected, and customers are being pointed to paper requisitions or Quanum eLabs in the meantime. The Record reports that Quest said the incident did not involve the recent PHP vulnerabilities, and that the company pledged to have Quanum back up by Friday. Quest has told law enforcement and brought in outside experts. BleepingComputer could not find a group claiming the attack, and a Quest spokesperson declined to tell The Record what kind of incident it was. The investigation is ongoing, so the scope may change.
How to check if you’re affected
Affected products are limited, per Quest’s notice, to the Quanum Lab Services Manager system, which “certain clients” use; Quest has not published a list of affected patients or data types. If your doctor’s office or hospital orders tests through Quanum LSM, ask them whether Quest has notified them and how they are handling orders while the system is paused.
- Patients: the sources say Quest is still determining what patient data was involved. Quest’s notice includes provider and patient FAQs; watch it and any letter from Quest or your provider rather than relying on rumors.
- As a general precaution (not from Quest), be wary of unsolicited calls, emails or texts that mention a Quest test or result and ask for payment or personal details. Contact Quest or your provider using details you already have.