KIungefiltert

· 4 min read · Auf Deutsch lesen

Quest Diagnostics: Attacker accessed patient data through the Quanum LSM ordering portal

US lab giant Quest Diagnostics reports unauthorized access to its Quanum Lab Services Manager. Patient data is affected, and there is still no victim count. Here's what is known and what to do.

security

Translated from the German original with an AI language model, approved by me. Read the original

Quest Diagnostics, one of the largest lab operators in the US, has confirmed a security incident. An attacker got unauthorized access to the Quanum Lab Services Manager (Quanum LSM) and reached patient data. I already flagged this on X and in the WhatsApp channel. Since then a few more details have come out, but the biggest question is still unanswered.

What happened

According to BleepingComputer, Quest discovered the access on October 21, 2026, and reported it the next day in an 8-K. That's a mandatory filing with the US Securities and Exchange Commission (SEC), which listed companies use to disclose material events. SecurityWeek carried the Associated Press report, which says Quest believes "certain patient records" were accessed.

Quanum LSM is a web platform for clinicians, hospitals and their staff. They use it to order lab tests, view results, track order status and order supplies. It isn't a patient portal, but it's where patients' order and result data comes together.

What has changed since the post

In the WhatsApp post I said there was no confirmed information about the data types. That's only partly true now. TechCrunch reports that Quest confirmed protected health information was taken, specifically "personal information and patient records." Quest is still working out which fields were involved, such as names, dates of birth, insurance details or actual results.

We now also know:

  • Quest shut Quanum LSM down. Customers have been told to use paper requisitions or the separate Quanum eLabs portal. Essential Insights and LabHQ have been paused as a precaution (BleepingComputer).
  • Quest says practices connected directly through lab system interfaces (LIS) or their electronic medical records (EMR) are not affected.
  • Federal law enforcement has been notified, and outside security experts are helping with the investigation.
  • Quest says the incident is unrelated to the PHP vulnerability that was in the news the same week (SecurityWeek/AP).
  • No threat group has claimed the attack so far.

Still unknown: the number of victims, the way in, and who did it. There's no CVE and no patch, because no specific vulnerability has been named. Be careful with articles citing 11.9 million victims. That number comes from the 2019 AMCA incident at a billing collections vendor and has nothing to do with this case.

Why it matters

Lab data is about as sensitive as it gets. A test order can reveal pregnancies, infections, drug screenings or chronic conditions. Unlike a password, none of that can be changed. It's also valuable to scammers because it makes their phishing believable: someone who knows your doctor, your lab and your test date sounds legitimate on the phone.

There's a structural problem too. The breach hit a portal used by third parties, meaning practices and hospitals. Patients never use this system themselves and often don't know their data is stored there. It's also not Quest's first incident: per the AP, data on about 34,000 people was exposed in 2016, and the AMCA breach followed in 2019.

Who is affected

Mainly patients in the US whose tests were ordered through practices or hospitals using Quanum LSM. Readers in Germany are unlikely to be directly affected. The lesson applies anywhere labs, practice software and outside portals exchange data, though.

What you should do

As a patient (especially in the US):

  • Watch for official notices from Quest or your provider. Under HIPAA, the US health privacy law, affected people must be notified no later than 60 days after discovery.
  • Be suspicious of unexpected calls or emails about lab results, outstanding payments or "identity checks."
  • Don't confirm personal details through links in messages. Call your provider yourself at a number you already know.
  • Check your insurance statements for services you never received.

As a practice, hospital or IT lead:

  • Take stock of which external portals process patient data and who has access to them.
  • Make sure your incident plan covers a vendor portal going down. Quest had to move customers to paper and backup portals on short notice.
  • Require multi-factor authentication for web portals that handle health data, and remove orphaned accounts.

I'll update this post once Quest releases a victim count or explains how the attacker got in.

Sources