Quest Diagnostics discloses cyberattack exposing patient records

Quest Diagnostics, one of the largest medical testing companies in the country, disclosed this week that an unauthorized party accessed patient records through a system clients use to order lab tests and retrieve results, the latest in a string of cyberattacks on the health care sector this year. In a filing with the Securities and Exchange Commission, the company said it learned of the unauthorized access on October 21 and immediately activated its cybersecurity incident-response procedures to contain the activity and assess its scope.

The breach involved Quanum LSM, a system certain clients use to place test orders and view results, according to the filing. Quest said it has notified federal law enforcement and hired outside cybersecurity specialists to investigate, and that it believes an unauthorized party "accessed certain patient records," though the company said the full scope of the intrusion remains under investigation. Quest, which trades on the New York Stock Exchange under the ticker DGX, said the incident has not materially disrupted its operations or its ability to serve patients, and the disclosure came the same day the company reported third-quarter revenue of $3.1 billion, up 10 percent from a year earlier, in a release posted to its newsroom.

A repeat target

Quest has been the target of a major breach before: in 2019, a billing contractor's breach exposed data on nearly 12 million Quest patients, one of the largest health care breaches reported in recent years. Companies covered by federal health privacy law are required to notify affected patients and, for breaches involving 500 or more people, to report the incident through the Department of Health and Human Services' Office for Civil Rights breach portal, though that notification typically follows weeks after an incident is first discovered rather than immediately. Quest's disclosure this week did not specify how many patients may be affected or when individual notifications would go out.

Patients whose providers use Quest's Quanum platform to order or review lab results are the most directly affected, though the company has not said whether the exposure extended to Quest's broader patient portal or billing systems. Health care providers and hospital systems that rely on Quanum for day-to-day ordering and reporting face the more immediate operational question of whether the system remains fully available while the investigation continues; Quest has said service has not been materially disrupted. Cybersecurity researchers tracking the health care sector have noted that laboratory and diagnostic companies have become increasingly frequent targets this year because their systems sit at the intersection of clinical data, insurance billing information and personal identifiers, making stolen records unusually valuable on criminal marketplaces.

Quest's stock traded lower in the days following the disclosure, though the company's shares remained within the range set by its third-quarter earnings report. The company has not said whether it will offer free credit monitoring or identity-protection services to affected patients, a step it and other breached health companies have taken after past incidents. Regulators, including state attorneys general who have pursued earlier health care breach cases, are likely to seek more detail once Quest determines the number of patients affected and completes the formal breach notifications required under federal and state law. Quest said it will provide updates as the investigation progresses.