Data Breach Notification
,
Data Privacy
,
Data Security
Medical Testing Lab Told SEC Incident Likely Compromised ‘Certain Patient Records’
Marianne Kolbasuk McGee (HealthInfoSec) •
October 22, 2026
Medical testing laboratory Quest Diagnostics told U.S. federal regulators that it discovered a hack on an IT system used by its clients, and that patient records were likely accessed. (Image: Quest Diagnostics)
Medical testing company Quest Diagnostics has told the U.S. Securities and Exchange Commission that it’s responding to a cyber incident involving its Quanum Lab Services Manager system, used by healthcare providers to place lab test orders, receive and look up lab results. See Also: Live Webinar | Hurtling Toward a Cybersecurity Crisis: The Hidden AI Risks Businesses Can’t See
Although the Quanum LSM hack is still under investigation, the Secaucus, New Jersey-based company said it believes an “unauthorized party” accessed “certain patient records.” “This incident has not materially disrupted the company’s business operations or its ability to serve patients,” the company told the SEC.
Still, Quest in a statement on its website said it has “paused” access to the LSM system while it investigates the incident. “Providers that use direct-customer LIS interfaces or EMRs to order testing from us may continue to place orders through those interfaces, which were not affected,” the company said, adding that it is “committed to full restoration” of its systems “as soon as possible.”
“It’s too early to attribute this to any specific group, and Quest hasn’t said who’s behind it,” said Jason Vest, chief technology officer at security Binary Defense. “But the profile is telling. The attackers went after a client-facing portal where test orders and results live, accessed patient records and didn’t disrupt operations. That looks a lot more like data theft and extortion than traditional ransomware,” he said.
Quest said that, upon discovery of the compromise, it promptly initiated its cybersecurity incident response procedures “to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures.”
The company also notified U.S. federal law enforcement.
Quest reported revenue of nearly $11.04 billion in 2025.
The Quest Diagnostics hack is the latest cyber incident in recent months involving a medical testing laboratory. Abbott Labs in July disclosed a cyber incident involving its Exact Sciences cancer testing unit. Notorious cybercrime gang ShinyHunters claimed on its dark website in July that it had stolen a cache of Abbott Labs data in the incident. But soon after, another gang – ShadowByt3$ – reportedly told media outlet BleepingComputer that it too recently stole Abbott Labs data in a separate incident.
Abbott Labs is facing multiple proposed class action lawsuits related to the incidents (see: Patient Sues Abbott Labs, Exact Sciences in Data Theft).
“Medical testing labs sit on a treasure trove of personal information – names, dates of birth, contact details, insurance data and, most importantly, test results. That’s high-value data that can be used for extortion long after the breach itself,” Vest said.
Lab portals also hold account credentials for the physicians, clinics and patients who use them, and usernames and passwords are always useful to attackers for getting into the next system, he said.
With medical testing labs and similar healthcare providers in the bullseye for cybercriminals, organizations should be on guard, said Ross Filipek, CISO at Corsica Technologies. “Start with a practical question – if someone takes over one client account, how much patient information can they reach? Test that boundary across the application and its connected systems. A successful login shouldn’t give someone unrestricted access to records,” he said.
Phishing-resistant MFA helps protect those accounts. Monitoring also needs to examine what happens after authentication, particularly unusual searches or bulk retrieval of patient information, he said. “Someone needs the authority to investigate and interrupt suspicious access promptly,” he said.
“Practice that response with the people who keep lab services running. They should know how to isolate an affected account or connection while preserving essential workflows. Working out those responsibilities during an incident costs valuable time.”
Click Here For The Original Source.
——————————————————–
