Quest Diagnostics, Used By 85 Million Americans Was Just Hit By Hackers — And Private Patient Files Were Accessed

Quest Diagnostics disclosed this week that there was an “unauthorized access” to its Quanum Lab Services Manager (LSM), an online portal used by physicians’ offices, hospitals, and clinics to order tests, receive results, and review patient files. According to the Daily Mail, the breach targeted a system that underpins routine care for roughly 85 million Americans, who depend on Quest for more than 3,500 types of laboratory exams, ranging from infectious disease testing and cancer screenings to genetic analysis, allergy panels, women’s health services, and standard blood work.

In a statement released Friday, the company acknowledged: “We believe some patient data within Quanum LSM was accessed, but other systems were not affected. We are working diligently to investigate the incident to determine the specific data affected.” Quest has so far declined to specify which categories of patient records were compromised or how many individuals may ultimately be swept up in the breach, leaving tens of millions of Americans to wonder whether their most intimate medical details are now in the hands of unknown actors.

The New Jersey-based firm said it has engaged outside cybersecurity specialists and is cooperating with law enforcement agencies as part of its response, a familiar pattern in a healthcare sector repeatedly caught flat-footed by sophisticated cybercriminals. Quest emphasized that its core laboratory operations have continued uninterrupted and that physicians can still order tests through alternative channels, even as the Quanum LSM platform remains offline after being shut down on Wednesday once the intrusion was detected.

This latest incident marks the second major data exposure involving Quest patients in recent years, raising serious questions about whether the healthcare industry and its regulators are doing enough to safeguard sensitive information. In 2019, a breach at a third-party billing contractor linked to Quest compromised the financial and medical data of nearly 12 million people, a failure that critics say reflects systemic weaknesses in how large healthcare vendors vet and monitor their partners.

Quest has confirmed that the compromised records in the current case include personal identifiers as well as “protected health information” (PHI), encompassing patient records along with diagnostic and billing data. The scale of the potential fallout is enormous, as the company processes hundreds of millions of tests annually and serves roughly half of all doctors and hospitals, touching the lives of about one in three American adults within the U.S. healthcare system.

The company has pledged to alert those affected “as required by applicable law” once investigators determine precisely whose data was accessed and what was taken, a legalistic assurance that may offer little comfort to patients who had no say in how their information was stored or secured. For now, Quest maintains that the attack has been contained, saying the intrusion was halted when Quanum LSM was disconnected from the network, though it has not publicly identified the perpetrators or their motives.

Based on its internal review so far, Quest says this breach is not connected to the recent PHP programming language crisis that disrupted websites across several countries this week. On the same day Quest uncovered its own incident, government portals, hospital systems, and school services in the Netherlands, Finland, France, and Denmark went offline as administrators rushed to patch two critical vulnerabilities in PHP-based systems.

PHP, which powers up to 70 percent of the world’s websites, operates behind the scenes whenever a user loads a page, with servers running PHP assembling content and transmitting it to the browser. In response to the newly discovered flaws, the U.S. National Security Agency and the FBI urged organizations relying on PHP to take vulnerable systems offline if they could not immediately apply security updates, a stark reminder that digital infrastructure remains a soft target even for basic public services.

Quest acknowledged that this is the third major hack to hit the company in less than a decade, a troubling record for a firm entrusted with some of the most sensitive data Americans possess. In 2016, Quest reported that lab results and contact information for about 34,000 individuals had been exposed in an online breach, an early warning that appears not to have prompted the level of hardening many conservatives argue is necessary when private entities hold quasi-public responsibilities.

According to Quest’s own frequently asked questions page posted after the latest incident, the company has not yet directly notified physicians who rely on Quest to process patient tests, even though those providers are on the front lines of explaining risks to their patients. “Once we complete the investigation we will notify affected providers and health plans as well as patients,” Quest wrote in a statement, a promise that may fuel renewed calls from the right for stricter accountability, stronger market incentives for cybersecurity, and less complacency from both corporate leaders and government overseers who have allowed critical health data to become an easy prize for hackers.