Quest Diagnostics told regulators on Thursday that an outsider had entered Quanum Lab Services Manager, SecurityWeek reported. Certain clients use this platform to send in test orders and to read their results. Quest said it found the problem on Wednesday and informed federal law enforcement. The New Jersey company is also working with outside cybersecurity experts.
Quest believes certain patient records were reached, but the number of patients and the kinds of records are unknown. Its investigation is still running, so the full scope is open. The reporting does not say how the attacker got in. Quest told The Associated Press on Thursday that the breach has no link to the recent PHP flaws.
A portal for orders and results sits close to patient records, so the way in is the key question. That detail is still missing. Buyers can press vendors on it, and ask who can see their data, how portal logins are checked, and what access logs are kept. Quest has had earlier incidents. In 2016, data on about 34,000 people was exposed in an online breach. In 2019, about 11.9 million patients were affected by a hack at billing vendor American Medical Collection Agency. Those are separate events from this one.