Major medical lab confirms patient data was stolen in new cyberattack

A major medical laboratory testing company has confirmed that a cyberattack successfully compromised sensitive patient data stored on one of its core platforms. Quest Diagnostics disclosed the incident in a filing to U.S. regulators, marking the latest significant security failure in a healthcare industry that has faced repeated digital assaults this year.

The company filed a notice with the U.S. Securities and Exchange Commission stating that it discovered the breach on Wednesday. The attack targeted a system called Quanum. This platform serves as a central hub for medical practices, hospitals, and doctor's offices. It allows these providers to request lab tests for patients and process the associated billing. Because of its function, the system holds a vast amount of protected health information, including detailed medical records, diagnostic results, and financial billing data.

Quest Diagnostics stated that the unauthorized access involved the retrieval of certain patient records. The company said it has already notified law enforcement and is currently conducting an investigation into the scope of the damage. A spokesperson for the company, Amanda Rivera, referred reporters to the company's security notice rather than answering specific questions about the timeline or the actors involved.

The breach highlights a persistent vulnerability in the health tech sector. Over the past several months, healthcare organizations have been prime targets for financially motivated cybercriminals. These attackers often steal large volumes of data and threaten to release it publicly if a ransom is not paid. This pattern of disruption has become common in the industry recently.

Several other major health tech companies have suffered similar fates this year. In March, a cyberattack led to the mass wiping of employee devices at medical technology maker Stryker. In August, a hack on Boston Scientific, a medical implant manufacturer, forced its network offline for weeks, causing global operational disruption. Additionally, major data breaches occurred at medical recordkeeping firm CareCloud, health tech provider Craneware, and pharmaceutical distributor McKesson.

Despite the confirmation of the breach, Quest Diagnostics has not yet revealed exactly how many patients or healthcare customers were affected. The company notes that Quanum is used by approximately half a million clinicians in thousands of locations across North America. While the total number of records is not public, a recent case study on the company's website suggests that a single health system with over six million patients can hold hundreds of millions of medical documents.

Officials have not specified when the unauthorized access began or if any hacking group has contacted Quest with demands for payment. The company's online security notice confirms that protected health information, including personal details and patient records, was taken. However, it remains unclear what specific categories of data were stolen. Notably, the webpage containing this notice includes code that tells search engines not to index the page, making it harder for the public to find the information through standard searches.

This is the second known major data breach for Quest Diagnostics in the last decade. The company previously lost 11.9 million patient records in 2019 due to a cyberattack on a third-party billing company. For readers in the Great Lakes and Ohio Valley who use local hospitals or clinics, this incident underscores the ongoing risk to personal health data stored in centralized digital systems.

The company continues to investigate the incident. As more details emerge, patients may need to look for specific notices from their doctors or hospitals regarding the Quanum platform. The situation remains fluid as the company works to determine the full extent of the compromise.