Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach

Medical laboratory investigating elephantine Quest Diagnostics has confirmed a cyberattack and information breach affecting an as-yet unspecified magnitude of delicate diligent accusation stored successful its systems, according to a legally required disclosure with U.S. regulators.

Quest said successful an 8-K filing with the U.S. Securities and Exchange Commission that it learned of a cyberattack connected Wednesday targeting 1 of its laboratory investigating systems, Quanum, which allows doctor’s offices, hospitals, and healthcare practices to petition laboratory tests for patients portion besides handling billing. The level stores a ample magnitude of diligent wellness and aesculapian records, arsenic good arsenic associated diagnostic and billing data.

The institution said the unauthorized entree included the accessing of “certain diligent records.” Quest said it notified instrumentality enforcement and is investigating.

The cyberattack connected Quest is the latest large cyber incidental to impact the healthcare manufacture this year. A bid of cyberattacks and information breaches person sparked weeks of disruption and allowed the theft of millions of diligent physics wellness records and different aesculapian information. Healthtech companies person go a large people for financially motivated cybercriminals, who purpose to bargain arsenic overmuch delicate information arsenic imaginable and endanger to people it if they aren’t paid a ransom. 

In caller months, a cyberattack resulted successful the mass-wiping of worker devices astatine aesculapian tech shaper Stryker successful March, and a hack connected aesculapian implant shaper Boston Scientific successful August forced the company’s web offline for weeks, sparking “global disruption” to its operations. Meanwhile, abstracted hacks passim the twelvemonth caused monolithic breaches of diligent information astatine aesculapian recordkeeping institution CareCloud, Scotland-based healthtech supplier Craneware, and U.S. pharmaceutical organisation elephantine McKesson.

Quest did not accidental erstwhile the breach began oregon whether immoderate hacking radical has contacted the institution with demands, specified arsenic outgo successful speech to not merchandise the stolen data. A spokesperson for Quest did not respond to TechCrunch’s petition for remark connected Friday.

The lab-testing elephantine has not yet said however galore healthcare customers, oregon patients, had accusation stolen during the onslaught connected its Quanum systems.

Quest’s website and materials accidental Quanum is utilized by astir fractional a cardinal clinicians successful thousands of locations crossed North America. It’s unclear however galore wellness records Quanum holds, but 1 2026 lawsuit study connected Quest’s website shows however a azygous wellness strategy with much than 6 cardinal patients tin clasp hundreds of millions of related aesculapian documents and charts.

In a enactment connected its website, Quest said that immoderate patients’ protected wellness accusation was taken, including “personal accusation and diligent records,” but the institution is inactive investigating what circumstantial kinds of information were taken. (The website station currently contains “noindex” code, which tells hunt engines not to database the leafage successful hunt results, making it acold much hard for radical to find the page.)

This is Quest’s 2nd known large information breach successful a decade, aft losing 11.9 cardinal diligent records successful a cyberattack connected a third-party billing institution successful 2019.

Do you enactment astatine Quest Diagnostics oregon cognize much astir the information breach? We’d emotion to perceive from you. You tin scope this newsman connected Signal astatine the username zackwhittaker.1337 oregon by email [email protected]