Lab testing large Quest Diagnostics confirms sufferers’ private and well being information was compromised throughout breach

Medical lab testing large Quest Diagnostics has confirmed a cyberattack and information breach affecting an as-yet unspecified quantity of delicate affected person info saved in its programs, in line with a legally required disclosure with U.S. regulators.

Quest stated in an 8-K filing with the U.S. Securities and Exchange Commission that it discovered of a cyberattack on Wednesday concentrating on certainly one of its lab testing programs, Quanum, which permits physician’s places of work, hospitals, and healthcare practices to request lab exams for sufferers whereas additionally dealing with billing. The platform shops a considerable amount of affected person well being and medical data, in addition to related diagnostic and billing information.

The firm stated the unauthorized entry included the accessing of “sure affected person data.” Quest stated it notified legislation enforcement and is investigating.

The cyberattack on Quest is the newest main cyber incident to have an effect on the healthcare trade this yr. A sequence of cyberattacks and information breaches have sparked weeks of disruption and allowed the theft of tens of millions of affected person digital well being data and different medical info. Healthtech firms have turn into a significant goal for financially motivated cybercriminals, who goal to steal as a lot delicate information as attainable and threaten to publish it in the event that they aren’t paid a ransom. 

In current months, a cyberattack resulted in the mass-wiping of employee devices at medical tech maker Stryker in March, and a hack on medical implant producer Boston Scientific in August pressured the company’s network offline for weeks, sparking “world disruption” to its operations. Meanwhile, separate hacks all year long triggered huge breaches of affected person information at medical recordkeeping firm CareCloud, Scotland-based healthtech supplier Craneware, and U.S. pharmaceutical distribution large McKesson.

The lab-testing large has not but stated what number of healthcare clients, or sufferers, had info stolen in the course of the assault on its Quanum programs.

Quest’s web site and supplies say Quanum is utilized by about half one million clinicians in 1000’s of areas throughout North America. It’s unclear what number of well being data Quanum holds, however one 2026 case study on Quest’s web site exhibits how a single well being system with greater than 6 million sufferers can maintain a whole lot of tens of millions of associated medical paperwork and charts.

Quest didn’t say when the breach started or whether or not any hacking group has contacted the corporate with calls for, comparable to cost in alternate to not launch the stolen information. Amanda Rivera, a spokesperson for Quest, didn’t reply TechCrunch’s questions in regards to the incident and referred to its security notice.

In the notice, Quest stated that some sufferers’ protected well being info was taken, together with “private info and affected person data,” however the firm remains to be investigating what particular sorts of information have been taken. (The web site put up currently contains “noindex” code, which tells search engines like google and yahoo to not record the web page in search outcomes, making it far harder for individuals to seek out the web page.)

This is Quest’s second identified main information breach in a decade, after losing 11.9 million patient records in a cyberattack on a third-party billing firm in 2019.

Do you’re employed at Quest Diagnostics or know extra in regards to the information breach? We’d love to listen to from you. You can attain this reporter on Signal on the username zackwhittaker.1337 or by e-mail [email protected]

Updated with a response from Quest.